AI analysis
CVE-2026-76722 is an uncontrolled format-string flaw in an affected interface on HPE Networking Instant On access points. An unauthenticated remote attacker can reach that interface and abuse the format-string bug to run arbitrary commands on the underlying host. Successful exploitation can cause a denial of service or, potentially, remote code execution, with full impact on confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). The issue affects HPE Networking Instant On APs; the supplied data does not name specific models or firmware versions. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Treat management and service interfaces on HPE Networking Instant On access points as untrusted: keep them off the public internet and limit access to trusted admin networks. Apply the vendor security update for the affected Instant On AP software as soon as HPE publishes a fixed release, and until then monitor for unexpected reboots or command execution. Confirm whether your models and firmware are in scope using HPE’s advisory, because this report does not list version ranges.
Affected
| Hewlett Packard Enterprise (HPE) Networking Instant On access points | — |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code execution.