HPE device EUVD-2026-108375

Per the CVSS vector, the attacker must be on a network adjacent to the affected HPE device - the same Layer 2 broadcast domain/local link or logically adjacent segment (AV:A) - so it is NOT exploitable directly from the internet; this adjacency requirement is the primary real-world limiter. Within that position, no authentication (PR:N) and no user interaction (UI:N) are needed, and attack complexity is low (AC:L), while the scope change (S:C) means impact can reach resources beyond the vulnerable component. The exact feature, protocol, or configuration that triggers the flaw is not described in the available sources (no CVE description provided); affected versions and any non-default-configuration requirement could not be confirmed from the input.

Multiple signals point to a genuine priority rather than an inflated CVSS score, but with an important scoping caveat. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, base 9.3 Critical) describes an adjacent-network, low-complexity, unauthenticated flaw requiring no user interaction, with a scope change and High confidentiality and integrity impact - a severe profile. The vuln.today decision label is 'act_now', and the issue is vendor-reported directly by HPE, which reinforces urgency. However, the key limiter is the attack vector: AV:A means exploitation requires the attacker to already be on the logically adjacent network (same L2 segment/VLAN/local link), NOT the open internet, so this is not mass-remotely exploitable like an AV:N flaw. Critically, NO EPSS score, NO CISA KEV listing, and NO proof-of-concept are present in the input - the single reference is the HPE vendor bulletin, not exploit code - so there is no evidence of active or widespread exploitation; the 'act_now' urgency is driven by severity and vendor disclosure, not by confirmed in-the-wild activity. One internal inconsistency to verify: the only tag is 'Information Disclosure' (a confidentiality concern), yet the vendor CVSS vector asserts I:H (High integrity impact) - the tag and the vector disagree about whether integrity is affected; confirm the actual impact with HPE.

An attacker positioned on the same adjacent network segment as the affected HPE device (e.g., a connected LAN/VLAN or local link) sends crafted traffic to it without needing credentials or any user interaction, exploiting a low-complexity flaw. The result is High confidentiality and integrity impact that, due to the scope change, can extend beyond the vulnerable component itself. No public exploit identified at time of analysis; the specific trigger mechanism is not described in the available sources.