HPE Unspecified Product EUVD-2026-108382

The CVSS vector requires the attacker to be on the adjacent network (AV:A) - the same broadcast domain or logically adjacent segment as the affected HPE device - rather than the public Internet, which substantially limits exposure. No authentication (PR:N) and no user interaction (UI:N) are needed, but high attack complexity (AC:H) means the attacker must satisfy conditions outside their direct control for the exploit to succeed, acting as a meaningful limiting factor. The specific product feature, protocol, configuration setting, or deployment mode that enables the flaw is not described in the available sources (no CVE description was provided); consult HPE bulletin hpesbnw05162en_us for the exact affected configuration and versions.

Signals are mixed and the underlying evidence is thin. The CVSS 3.1 base score is 8.3 (High) with vector AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - meaning adjacent-network reach, no authentication, no user interaction, a changed scope, and total compromise of confidentiality, integrity and availability. However, the adjacent attack vector (AV:A) narrows exposure to attackers already on the same logical/physical network segment, and the high attack complexity (AC:H) indicates conditions outside the attacker's control must be met, which lowers real-world exploitability relative to the raw score. No EPSS probability was supplied, the CVE is NOT listed in CISA KEV, and no public exploit or PoC reference was provided, so there is no evidence of active exploitation. The vuln.today decision label is 'this_week', indicating prompt but not emergency remediation. Two data conflicts must be flagged explicitly: (1) the only tag is 'Information Disclosure', yet the CVSS vector asserts full C:H/I:H/A:H impact including integrity and availability - the tag understates the stated impact; verify scope of impact with HPE. (2) No description was provided, so the trigger mechanism and affected product/version cannot be confirmed from the input - treat mechanism-level claims as unverified pending the HPE bulletin (hpesbnw05162en_us).

An attacker positioned on the same adjacent network segment as a vulnerable HPE networking device sends specially-conditioned traffic to the affected service, without needing credentials or user interaction. Because attack complexity is high, success depends on conditions the attacker does not fully control; if met, the scope-changing flaw lets the attacker breach components beyond the vulnerable module. No public exploit code or PoC reference was provided in the available data.