HPE Networking Devices EUVD-2026-108376

Exploitation requires the attacker to hold an adjacent-network position (AV:A) - the same local segment / broadcast domain or a logically adjacent network as the affected HPE networking device - rather than arbitrary internet reach; this is the primary limiting factor. Per the CVSS vector the attack is unauthenticated (PR:N) and needs no user interaction (UI:N), with low attack complexity (AC:L). The specific product feature, protocol, or configuration that must be reachable is not described in the available sources (no description was provided), so the concrete trigger condition cannot be named; defenders should treat adjacent-network reachability of the HPE device as the key gating prerequisite.

Signals are mixed and incomplete. The CVSS 3.1 base score of 9.3 (critical) is driven by an adjacent-network, low-complexity, unauthenticated, no-interaction vector with a changed scope (S:C) and high confidentiality and availability impact (C:H/A:H). Crucially the attack vector is AV:A (Adjacent), not AV:N (Network), so this is not internet-wide mass-exploitable - the attacker must already hold a position on the same logical/adjacent network segment as the affected HPE networking device, which materially narrows realistic exposure versus the raw 9.3 implies. The vuln.today decision label is act_now, which signals vendor/aggregator-assessed urgency and should drive prompt patching. However, EPSS probability is not provided, there is no CISA KEV listing in the input (so no confirmed active exploitation), and no PoC or exploit reference is present, so there is currently no public exploit identified at time of analysis. The most significant limitation is that NO vulnerability description and no CWE were supplied, so the mechanism (what is disclosed, how availability is lost, why scope changes) cannot be verified - the act_now urgency therefore rests on the vendor's own HPE bulletin rather than on independently confirmable exploitation data. Net: treat as a high-priority patch per the act_now label and the critical adjacent-network impact, but recognize the real-world risk is gated by requiring adjacent-network access and that key corroborating signals (EPSS, KEV, description) are absent.

An attacker already positioned on the same adjacent/local network segment as the affected HPE networking device sends crafted traffic to it without authentication or any user interaction, obtaining confidential information and disrupting availability, with impact extending beyond the vulnerable component due to the changed scope. The precise trigger is not described in the available sources. No public exploit or PoC reference is present in the input.