AOS-S EUVD-2026-93876

The attacker needs network access to the AOS-S device's affected service/management plane. The supplied description does not name the exact feature, protocol, port, or configuration mode involved, so the specific vulnerable surface cannot be stated with precision from available data - verify against HPE advisory hpesbnw05156en_us. Limiting/clarifying factors: the CVSS vector specifies PR:L (some privilege required) and no user interaction (UI:N), but the description claims the attacker is unauthenticated; this authentication precondition is unresolved and materially changes exploitability. Impact is confined to confidentiality (C:H, I:N, A:N) - no code execution, data tampering, or denial of service results directly from this flaw.

This is a moderate-priority information-disclosure flaw whose signals are partially conflicting and thin. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity attack that requires LOW privileges (PR:L) and yields HIGH confidentiality impact with no integrity or availability effect. However, the NVD/vendor description explicitly states an 'unauthenticated remote attacker' - this directly contradicts PR:L in the vector. This discrepancy must be resolved with HPE before prioritization: if exploitation is truly unauthenticated, real-world risk and the correct CVSS are higher (base ~7.5) than the stated 6.5. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. Net: a network-exposed confidentiality bug on enterprise switching gear that warrants patching in a normal cycle, but the exploitation probability appears low and the authentication precondition is unresolved. Treat the 'unauthenticated' claim as the worst case until the vendor clarifies.

A remote attacker with network reachability to the management plane of an HPE Aruba AOS-S switch sends a crafted request to a vulnerable service and receives sensitive information (e.g., configuration or credential-adjacent data) in the response. The CVSS vector's low attack complexity (AC:L) and network vector (AV:N) mean no special timing or conditions are needed, though the vector's PR:L implies some level of access that the description's 'unauthenticated' wording disputes. No public exploit code was provided in the intelligence.