HPE Networking EUVD-2026-108374

Exploitation requires the attacker to occupy an adjacent network position (AV:A) relative to the affected HPE device - the same Layer 2 segment, broadcast domain, or directly-connected logical network - and is therefore not reachable from arbitrary internet hosts. No authentication (PR:N) and no user interaction (UI:N) are needed, and complexity is low (AC:L), so once adjacency is achieved exploitation is straightforward. Scope is changed (S:C), meaning impact extends beyond the vulnerable component to a separate security authority. The exact feature, protocol, or configuration that triggers the flaw is not described in the available sources (no description or CWE was provided), so no specific enabling setting can be named; the primary limiting factor is the adjacency requirement, which confines exploitation to attackers with local network reach.

The input CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, base 9.3) describes an unauthenticated, low-complexity flaw requiring no user interaction, with a changed scope and high confidentiality and integrity impact - severe on paper. The single most important tempering signal is AV:A (Adjacent): this is NOT internet-wide/remote exploitation; an attacker must already sit on the same adjacent network (shared L2 segment, broadcast domain, or directly-connected logical network) as the affected HPE device, so it is not wormable across the internet and exposure depends on network segmentation. Exploitation-likelihood signals are largely absent or conflicting: no EPSS score is provided, the CVE is not listed in CISA KEV, and no PoC or exploit reference is supplied - so there is no public exploit identified at time of analysis and no evidence of active exploitation. This conflicts with the vuln.today Decision label of 'act_now', which appears driven by the high base score plus the unauthenticated/adjacent profile and first-party vendor (HPE) reporting rather than by observed exploitation. Additionally, the only categorization signal, the 'Information Disclosure' tag, is in tension with the vector's I:H (integrity) claim - pure information disclosure would normally be confidentiality-centric; verify the true integrity impact with HPE. Net: treat as a real, high-priority patch item for environments where untrusted parties can reach the device at Layer 2 (shared/guest networks, campus LANs, multi-tenant segments), but recognize that active-exploitation evidence is currently missing and the exact mechanism is undocumented.

An attacker positioned on the same adjacent network as a vulnerable HPE Networking device (e.g., a shared LAN or wireless segment) sends crafted traffic to it without any authentication or user interaction, exploiting the flaw to read high-confidentiality data and, per the vendor vector, affect integrity across a trust boundary (scope changed). The specific trigger is not described in the available sources, and no public exploit has been identified at time of analysis.