HPE Networking EUVD-2026-108369

Exploitation requires the attacker to have Adjacent network access (AV:A) - i.e. presence on the same local/logical network segment (such as a shared VLAN, broadcast domain, or directly attached link) as the affected HPE networking device; it is NOT reachable from the open internet without first obtaining that adjacency. Within that position, no authentication (PR:N) and no user interaction (UI:N) are needed and attack complexity is low (AC:L). The specific product feature, protocol, or configuration mode that triggers the flaw is not described in the available sources (no description or CWE provided). The primary limiting factor is therefore the adjacency requirement, which confines realistic attackers to those with local network foothold or physical/adjacent proximity.

The CVSS 3.1 base score of 9.6 (Critical) is driven by an unauthenticated (PR:N), low-complexity (AC:L), no-interaction (UI:N) vector with a scope change (S:C) and full confidentiality, integrity and availability impact (C:H/I:H/A:H). Crucially the attack vector is Adjacent (AV:A), NOT Network - exploitation requires the attacker to already be on the same logical/physical adjacent network segment as the affected HPE networking device, so this is not directly internet-reachable and the real-world blast radius is narrower than a comparable AV:N 9.6 flaw. The vuln.today decision label is 'act_now', signalling high remediation urgency, yet no KEV listing, EPSS probability, or PoC/exploit reference was supplied, so there is no public exploit identified at time of analysis and no evidence of active or at-scale exploitation - the urgency appears to rest on severity and vendor advisory rather than observed in-the-wild activity. Two signals should be verified before treating this as confirmed fact: there is NO vulnerability description and NO CWE, so the mechanism is unknown; and the single tag 'Information Disclosure' conflicts with the supplied vector's I:H/A:H (integrity/availability impact), which implies more than disclosure - verify the actual impact and trigger with HPE bulletin hpesbnw05162en_us.

An attacker positioned on the same adjacent network segment as a vulnerable HPE networking device (e.g. a connected management or client VLAN) sends crafted traffic to the device without any authentication or user interaction. Because the scope changes (S:C), successful exploitation lets the attacker impact resources beyond the vulnerable component itself, potentially compromising confidentiality, integrity and availability across a security boundary. No public exploit code or PoC reference was provided, and the exact trigger is not described in the available sources.