EUVD-2026-108396
GHSA-w9qq-m55p-2r9x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device over network
-
ExploitSend crafted request to vulnerable service
-
ImpactTrigger availability fault, deny service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) exploitation is remote and unauthenticated with no user interaction against a network-reachable service, implying default-reachable functionality. However, no CVE description was provided, so the exact affected feature, protocol, port, or configuration that triggers the fault is not described in the available sources and must be read from HPE bulletin hpesbnw05162en_us. The principal limiting factor is network reachability to the affected HPE networking device: deployments that restrict management/data-plane exposure or sit behind segmentation materially reduce exposure, and the specific affected product and versions are not confirmed in the input. |
| Impact | The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, with impact confined entirely to availability (C:N/I:N/A:H) - i.e. a remote unauthenticated denial-of-service condition, not a data-exposure issue. This directly CONFLICTS with the single input Tag 'Information Disclosure': a disclosure bug would be expected to carry confidentiality impact (C:L/H), but the authoritative vector sets C:N. Treat the availability (DoS) characterization as the governing signal and verify the actual impact against HPE bulletin hpesbnw05162en_us. On exploitation signals, no EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided, so there is no public exploit identified at time of analysis and no evidence of active or probable near-term exploitation; the only urgency input is the vuln.today 'this_week' decision label. Net: a genuinely remotely triggerable unauthenticated DoS in HPE networking gear is worth patching on a near-term (this-week) cadence, but in the absence of KEV/EPSS/PoC it is a serviceability/availability priority rather than a confirmed-exploitation emergency, and the mislabeled impact tag should be corrected before it drives disclosure-focused response work. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network reachability to the affected HPE networking device sends crafted traffic to a listening service, triggering a fault that crashes or exhausts the component and denies service to legitimate users. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, no user interaction, and no special timing are required. No public exploit code or PoC reference was provided in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Denial of service against an as-yet-unnamed HPE networking product lets remote, unauthenticated attackers degrade or halt availability, scored CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with impact confined entirely to availability. The affected feature, protocol, port and firmware branches are not described in the available sources and must be read from HPE bulletin hpesbnw05162en_us; no public exploit was identified at time of analysis and no EPSS or KEV signal was supplied. The vuln.today priority decision is this_week, reflecting a remotely reachable, low-complexity fault whose practical exposure scales with how far the device is reachable from untrusted networks.
RemediationAI
Patch status is not confirmed in the available data: no fix version, commit or patch reference was supplied, so the fixed firmware release must be taken directly from HPE bulletin hpesbnw05162en_us, and no version number should be assumed from this analysis. Until that bulletin is applied, the actionable control identified in the assessment is reachability reduction - restrict management- and data-plane exposure of affected HPE networking devices to trusted administrative segments and place them behind network segmentation, accepting the operational trade-off that this narrows remote management paths and may require jump hosts or VPN access for administrators. Because the specific triggering feature, protocol and port are not described in the available sources, no feature-level disable or port-level block can be recommended with confidence; that detail has to come from the HPE bulletin. No public exploit was identified at time of analysis, so no exploit-specific mitigation is warranted beyond the exposure reduction above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The record carries no CWE and no description, so the underlying component and root-cause class cannot be stated; what is confirmed is only the severity profile - a network-vector, low-complexity, no-privilege, no-interaction condition (AV:N/AC:L/PR:N/UI:N/S:U) whose sole impact metric is availability (A:H with C:N/I:N/A:H). That combination points to a fault in reachable request or protocol handling on an HPE networking device, but the trigger itself is not described in the available sources and must be determined from HPE bulletin hpesbnw05162en_us. One internal inconsistency is worth noting: the record is tagged 'Information Disclosure' while the CVSS vector asserts no confidentiality impact at all, so the tag should be treated as unverified until the vendor bulletin reconciles it. No CPE data was supplied, so the exact model and firmware enumeration is likewise unconfirmed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vector indicates a remote, low-complexity, unauthenticated flaw with availability-only impact (C:N/I:N/A:H), consistent with a network-triggered denial of service; retained as supplied since no description refines the metrics.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
No description provided
Executive ViewAI
A high-severity denial-of-service vulnerability has been identified in an HPE networking product, allowing unauthenticated remote attackers to disrupt network availability. This could lead to service outages, operational disruptions, and potential SLA violations, affecting customers and internal users relying on the network infrastructure. Leadership should prioritize remediation to maintain business continuity and trust.
No vendor-released patch identified at time of analysis. Interim mitigations include limiting network exposure of affected devices (e.g., via firewall rules, ACLs), monitoring for DoS conditions, and implementing rate limiting or traffic filtering; follow HPE bulletin hpesbnw05162en_us for specific guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB