EUVD-2026-108386
GHSA-65qq-xchp-v7p8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-facing HPE service
-
ExploitSend crafted unauthenticated request
-
ImpactDisrupt availability and tamper integrity
Vulnerability Assessment
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are indicated - remote unauthenticated exploitation over the network with no user interaction against the affected HPE networking product. LIMITING FACTORS: no description was supplied, so the exact affected product, feature, protocol, deployment mode and vulnerable versions are not identified in the available data; exposure is limited to deployments where the affected network service is reachable by the attacker. The specific trigger condition is not described in the available sources and should be confirmed against HPE bulletin hpesbnw05162en_us. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a highly reachable flaw: network-exploitable, low complexity, no privileges and no user interaction, which is why the base score is 8.2. However, the impact metrics are narrow - C:N (no confidentiality impact), I:L (low integrity) and A:H (high availability) - so the realistic consequence is service disruption/denial-of-service with minor integrity effect, not data theft. This directly conflicts with the single 'Information Disclosure' tag, which implies a confidentiality impact that the authoritative vector explicitly denies (C:N); this contradiction should be resolved with the HPE advisory. No EPSS score, no CISA KEV listing and no POC reference were provided, so there is no evidence of active exploitation or published exploit code at this time. The vuln.today priority is 'this_week' (not act_now/emergency), consistent with a high-exploitability but availability-centric issue from a vendor advisory rather than a confirmed in-the-wild threat. Net: a genuine high-severity, easy-to-reach vulnerability worth prompt patching, but currently an unexploited availability issue rather than a confirmed critical emergency - and the true impact nature is uncertain because no description was supplied. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a network-exposed service on the affected HPE networking product, requiring no privileges or user interaction, to disrupt service availability and cause limited integrity impact. The precise trigger is not described in the available sources. No public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Remote, unauthenticated attackers can cause high availability impact and limited integrity impact against an HPE networking product, per a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) published with HPE bulletin hpesbnw05162en_us. No description, CWE, CPE or version data accompanied the CVE record, so the specific product line, interface, protocol and affected release range are not identified in the available sources and must be confirmed from the HPE bulletin. No public exploit code and no confirmed active exploitation are indicated at time of analysis, and the issue is prioritized as 'this_week' rather than an emergency, but the vector describes a low-complexity, no-prerequisite network attack path that warrants prompt confirmation of exposure.
RemediationAI
No vendor-released patch version is identified in the available data, so the first action is to retrieve HPE Security Bulletin hpesbnw05162en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US) and confirm which models, firmware branches and fixed releases it lists, then apply the fixed firmware it specifies for each branch in use. Because the exact feature and protocol are not identified in the available sources, no specific feature-disable or port-block instruction can be justified from this dataset; the one exposure lever supported by the assessment is reachability, since impact is limited to deployments where the affected network service is reachable by the attacker. Until the bulletin clarifies the affected interface, restrict management or service-plane access to the affected device to trusted network segments and administrative source addresses, accepting that this reduces but does not remove risk if the vulnerable path is reachable from legitimate client networks, and monitor the device for availability disruption and unexpected configuration or state changes given the A:H and I:L components of the vector. Escalate to HPE support for a confirmed fix timeline if the bulletin does not list a remediation for the deployed branch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The only structured technical evidence is the CVSS 3.1 vector: network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact and high availability impact. That combination points to something reachable over the network without credentials that can disrupt service availability and, to a lesser degree, modify data or state. CWE is not assigned in the available data and no description was supplied, so the root-cause class, the vulnerable component and the trigger condition are not described in the available sources; the exact mechanism should not be inferred from the vector alone. The CVE carries the tag 'Information Disclosure', which does not align with the assessed C:N (no confidentiality impact) - the tag appears to be a reporter-side or feed-side classification rather than a reflection of the assessed impact, and the authoritative HPE bulletin hpesbnw05162en_us is the source that should resolve both the affected feature and the true impact profile. No CPE strings were provided, so the affected product family and version boundaries cannot be enumerated from this dataset.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
No description was provided, so I align with the published network/unauthenticated metrics; availability-high dominates, while the 'Information Disclosure' tag is unsupported by C:N.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
No description provided
Executive ViewAI
CVE-2026-79886 presents a high-severity risk to HPE networking products, allowing unauthenticated remote attackers to disrupt service availability and potentially manipulate limited data. Business operations relying on these network devices face potential outages that could affect productivity and customer-facing services. Leadership should prioritize patch verification and interim mitigations to prevent disruption.
No vendor-released patch identified at time of analysis. As interim mitigations, restrict network access to affected HPE devices to trusted management networks, enforce authentication and encryption on management interfaces, and monitor for anomalous network traffic. Where feasible, deploy intrusion prevention systems to detect and block exploitation attempts, and maintain offline backups of device configurations for rapid recovery.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB