GBHackerspublished Oct 1, 08:01 UTC (7d ago)ingested Oct 1, 08:17 UTCby Divya

HPE Instant On AP Flaws Let Unauthenticated Attackers Execute Arbitrary Commands

highVulnerabilityimportance 68CVE-2026-76721 CVE-2026-76722 CVE-2026-76723 CVE-2026-76724 CVE-2026-76725 CVE-2026-76726 CVE-2026-76727 CVE-2026-76728 CVE-2026-76729 CVE-2026-76730 CVE-2026-76731 CVE-2026-76732 CVE-2026-76733 CVE-2026-76734 CVE-2026-76735 CVE-2026-76736 CVE-2026-76737 CVE-2026-76738

AI summary · grok-4.7

HPE patched 18 Instant On AP flaws, including unauthenticated remote code execution scored CVSS 9.8.

HPE advisory HPESBNW05150 covers 18 vulnerabilities in Networking Instant On access points running software 3.4.1.0 and earlier. CVE-2026-76721 and CVE-2026-76722, both CVSS 9.8, allow unauthenticated remote buffer-overflow code execution or format-string command execution. Three additional critical flaws scored 9.6 require adjacent-network access and can enable command injection, authentication bypass, or remote code execution. HPE said it was unaware of public exploit code as of September 29 and recommends upgrading to 3.4.2.0 or later, with automatic updates for eligible cloud-managed devices.

Eighteen flaws affect Instant On AP software 3.4.1.0 and earlier.
CVE-2026-76721 and CVE-2026-76722 are unauthenticated remote flaws scored CVSS 9.8.
Three adjacent-network flaws scored 9.6 can lead to command execution or authentication bypass.
HPE knew of no public exploit code as of the September 29 advisory.
Upgrade to 3.4.2.0 or later; eligible devices can update via the cloud portal.

Read the original

VendorsHPE

ProductsHPE Networking Instant On Instant On AP

OrganizationsHPE

Tags#hpe #instant-on #access-point #rce #authentication-bypass #cve-2026-76721 #patch

Vulnerabilities mentionedAll →

CVE-2026-767219.8—
Unauthenticated buffer overflow RCE in HPE Networking Instant On
published 9d ago· Hewlett Packard Enterprise HPE Networking Instant On+2 related
CVE-2026-767249.6—
Unauthenticated command injection in HPE Instant On APs
published 9d ago· HPE Networking Instant On access points+3 related

Full article550 words · extracted from gbhackers.com · click to collapse

HPE has released security updates for its Networking Instant On access points after identifying 18 vulnerabilities, including several critical flaws that could allow unauthenticated attackers to execute arbitrary code or commands with privileged operating-system access.

These vulnerabilities are detailed in advisory HPESBNW05150 rev. 1 and affect Instant On AP software versions 3.4.1.0 and earlier. HPE recommends that users upgrade to version 3.4.2.0 or later. Fixes will be automatically applied to eligible devices through the Instant On cloud management portal.

HPE Instant On AP Flaws

The most severe vulnerabilities are CVE-2026-76721 and CVE-2026-76722, both rated 9.8 out of 10 on the CVSS v3.1 scale. The first vulnerability is an unauthenticated remote buffer overflow flaw that could enable arbitrary code execution as a privileged user.

The second involves uncontrolled format-string vulnerabilities that could allow unauthenticated attackers to execute commands or trigger a denial-of-service condition.

Additionally, there are three other critical flaws, CVE-2026-76723, CVE-2026-76724, and CVE-2026-76725, each carrying a CVSS score of 9.6.

While these require access from adjacent networks rather than direct Internet connectivity, they could still facilitate arbitrary command execution, command injection through the PAPI-acquired command-line interface, or authentication bypass leading to elevated remote code execution.

The advisory also addresses CVE-2026-76726, an unauthenticated remote API authentication-bypass flaw with a CVSS score of 8.1. Under certain conditions beyond the attacker’s control, exploiting this vulnerability could allow unauthorized access to restricted networks.

CVE Details

CVE	Severity	CVSS	Attack requirement	Impact
CVE-2026-76721	Critical	9.8	Unauthenticated, remote	Buffer overflow; privileged RCE
CVE-2026-76722	Critical	9.8	Unauthenticated, remote	Format string; command execution/DoS
CVE-2026-76723	Critical	9.6	Unauthenticated, adjacent	Buffer overflow; arbitrary commands/RCE
CVE-2026-76724	Critical	9.6	Unauthenticated, adjacent	PAPI CLI command injection
CVE-2026-76725	Critical	9.6	Unauthenticated, adjacent	Management-protocol authentication bypass; potential RCE
CVE-2026-76726	High	8.1	Unauthenticated, remote	API authentication bypass; unauthorized network access
CVE-2026-76727	High	7.2	Authenticated, remote, high privilege	Command injection
CVE-2026-76728	High	7.2	Authenticated, remote, high privilege	SSRF leading to privileged command execution
CVE-2026-76729	Medium	6.6	Authenticated, remote, high privilege	Format string; memory corruption, DoS or RCE
CVE-2026-76730	Medium	6.5	Unauthenticated, adjacent	PAPI authentication bypass; unauthorized traffic
CVE-2026-76731	Medium	6.5	Unauthenticated, remote	Captive-portal authentication bypass
CVE-2026-76732	Medium	6.4	Authenticated, local, high privilege	Local privilege escalation to root
CVE-2026-76733	Medium	4.9	Authenticated, remote, admin	API denial of service
CVE-2026-76734	Medium	4.8	Unauthenticated, remote	Memory-corruption denial of service
CVE-2026-76735	Medium	4.1	Authenticated, local, high privilege	Sensitive-information disclosure
CVE-2026-76736	Low	3.3	Authenticated, local, low privilege	Buffer-overflow denial of service
CVE-2026-76737	Low	3.0	Authenticated, local, admin	Path traversal; limited file modification/DoS
CVE-2026-76738	Low	2.7	Authenticated, remote, admin	API buffer-overflow denial of service

Organizations should prioritize updating all supported Instant On APs to 3.4.2.0 or later. HPE also recommends isolating web-based management interfaces on a dedicated Layer 2 segment or VLAN, enforcing Layer 3-plus firewall policies, and maintaining activity and resource-use logging.

Deployments running end-of-maintenance releases should be treated as potentially exposed. HPE said it was unaware of public discussion or exploit code targeting these flaws as of the advisory’s September 29 release, but urged customers to patch given the breadth and potential impact of the vulnerabilities.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

CVE	Vulnerability	CVSS	EPSS	Affected	Exposure	Published
CVE-2026-76721 +2 related CVEs CVE-2026-76722 CVE-2026-76723	Unauthenticated buffer overflow RCE in HPE Networking Instant On A buffer overflow in an affected interface of HPE Networking Instant On lets an unauthenticated remote attacker run arbitrary code on the underlying host. The issue is network-reachable with low attack complexity and no user interaction, and successful exploitation executes code as a privileged user on the device operating system. Confidentiality, integrity, and availability are all rated high, with a CVSS 3.1 base score of 9.8. Affected deployments are those running HPE Networking Instant On; the provided data does not name specific version ranges. No public proof of concept is known, and the CVE is not listed in CISA KEV. Do: Apply HPE's official security update for Networking Instant On as soon as fixed firmware for your models is published, and do not leave the affected interface reachable from untrusted networks. Until then, restrict that interface to trusted management networks, review logs for unexpected privileged activity, and confirm your build only against HPE's advisory rather than assuming a version is safe.	9.8 group max	—	Hewlett Packard Enterprise HPE Networking Instant On	—	9d ago
CVE-2026-76724 +3 related CVEs CVE-2026-76726 CVE-2026-76727 CVE-2026-76728	Unauthenticated command injection in HPE Instant On APs A command-injection flaw in the CLI of HPE Networking Instant On access points lets an unauthenticated attacker who is adjacent to the device send specially crafted packets and run arbitrary commands as a privileged user on the underlying operating system. The issue is rated critical (CVSS 3.1 9.6) with adjacent access, low complexity, no privileges, and no user interaction, and a changed scope with high impact to confidentiality, integrity, and availability. It affects HPE Networking Instant On APs; the provided data does not list specific models or version ranges. There is no CISA KEV listing and no public proof-of-concept is known, so exploitation in the wild is not indicated from this data. Do: Apply the HPE firmware fix for affected Instant On access points as soon as it is available for the models you run; the advisory data does not name a fixed version. Until then, keep the AP CLI off untrusted adjacent networks (management VLAN only, no exposure on guest or client segments) and alert on unexpected privileged command execution on the AP OS.	9.6 group max	—	HPE Networking Instant On access points	—	9d ago
CVE-2026-76725	Auth bypass to RCE in HPE Instant On access points A critical flaw in a management protocol on HPE Networking Instant On access points lets an unauthenticated attacker on an adjacent network bypass existing authentication controls. The issue requires no privileges and no user interaction, and successful exploitation can completely circumvent security restrictions. Impact can include remote code execution with elevated privileges, with high effects on confidentiality, integrity, and availability and a changed security scope (CVSS 9.6, adjacent). HPE Networking Instant On access points are affected; the provided data does not name specific models or firmware versions. There is no known public proof of concept, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. Do: Apply the vendor security update for HPE Networking Instant On access points as soon as HPE publishes a fixed build, and use the official advisory to confirm which models and firmware versions are covered. Until then, keep the management protocol off untrusted adjacent networks and limit which devices can reach AP management. Review access-point logs for unexpected unauthenticated management-protocol activity.	9.6	—	HPE Networking Instant On access points	—	9d ago
CVE-2026-76729	A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause… A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote code execution in the affected system function. NVD description · AI analysis pending	6.6	—	—	—	9d ago
CVE-2026-76730	An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to… An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication mechanisms and send unauthorized network traffic to the target device. NVD description · AI analysis pending	6.5	—	—	—	9d ago
CVE-2026-76731	An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing… An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain limited access to some data and to make limited changes within the affected component. NVD description · AI analysis pending	6.5	—	—	—	9d ago
CVE-2026-76732	affected daemon of HPE Networking Instant ON: Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root… A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met outside of the attacker's control. NVD description · AI analysis pending	6.4	—	—	—	9d ago
CVE-2026-76733	A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative… A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service, which resumes without manual intervention. NVD description · AI analysis pending	4.9	—	—	—	9d ago
CVE-2026-76734	A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of… A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service and to access some limited information within the affected component. NVD description · AI analysis pending	4.8	—	—	—	9d ago
CVE-2026-76735	A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authenticated local attacker with high privileges to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Instant On, only if certain preconditions outside of the attacker's control are met. NVD description · AI analysis pending	4.1	—	—	—	9d ago
CVE-2026-76736	A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow a low-privilege authenticated local attacker to interrupt the normal operation of the affected service. NVD description · AI analysis pending	3.3	—	—	—	9d ago
CVE-2026-76737	An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of the affected service. NVD description · AI analysis pending	3.0	—	—	—	9d ago
CVE-2026-76738	A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative… A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service, which recovers without manual intervention. NVD description · AI analysis pending	2.7	—	—	—	9d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-76721

+2 related CVEs

CVE-2026-76722 CVE-2026-76723

Unauthenticated buffer overflow RCE in HPE Networking Instant On

A buffer overflow in an affected interface of HPE Networking Instant On lets an unauthenticated remote attacker run arbitrary code on the underlying host. The issue is network-reachable with low attack complexity and no user interaction, and successful exploitation executes code as a privileged user on the device operating system. Confidentiality, integrity, and availability are all rated high, with a CVSS 3.1 base score of 9.8. Affected deployments are those running HPE Networking Instant On; the provided data does not name specific version ranges. No public proof of concept is known, and the CVE is not listed in CISA KEV.

Do: Apply HPE's official security update for Networking Instant On as soon as fixed firmware for your models is published, and do not leave the affected interface reachable from untrusted networks. Until then, restrict that interface to trusted management networks, review logs for unexpected privileged activity, and confirm your build only against HPE's advisory rather than assuming a version is safe.

9.8

group max

—

Hewlett Packard Enterprise HPE Networking Instant On

—

9d ago

CVE-2026-76724

Unauthenticated command injection in HPE Instant On APs

A command-injection flaw in the CLI of HPE Networking Instant On access points lets an unauthenticated attacker who is adjacent to the device send specially crafted packets and run arbitrary commands as a privileged user on the underlying operating system. The issue is rated critical (CVSS 3.1 9.6) with adjacent access, low complexity, no privileges, and no user interaction, and a changed scope with high impact to confidentiality, integrity, and availability. It affects HPE Networking Instant On APs; the provided data does not list specific models or version ranges. There is no CISA KEV listing and no public proof-of-concept is known, so exploitation in the wild is not indicated from this data.

Do: Apply the HPE firmware fix for affected Instant On access points as soon as it is available for the models you run; the advisory data does not name a fixed version. Until then, keep the AP CLI off untrusted adjacent networks (management VLAN only, no exposure on guest or client segments) and alert on unexpected privileged command execution on the AP OS.

9.6

group max

—

HPE Networking Instant On access points

—

9d ago

CVE-2026-76725

Auth bypass to RCE in HPE Instant On access points

A critical flaw in a management protocol on HPE Networking Instant On access points lets an unauthenticated attacker on an adjacent network bypass existing authentication controls. The issue requires no privileges and no user interaction, and successful exploitation can completely circumvent security restrictions. Impact can include remote code execution with elevated privileges, with high effects on confidentiality, integrity, and availability and a changed security scope (CVSS 9.6, adjacent). HPE Networking Instant On access points are affected; the provided data does not name specific models or firmware versions. There is no known public proof of concept, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Do: Apply the vendor security update for HPE Networking Instant On access points as soon as HPE publishes a fixed build, and use the official advisory to confirm which models and firmware versions are covered. Until then, keep the management protocol off untrusted adjacent networks and limit which devices can reach AP management. Review access-point logs for unexpected unauthenticated management-protocol activity.

9.6

—

HPE Networking Instant On access points

—

9d ago

CVE-2026-76729

A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause…

A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote code execution in the affected system function.

NVD description · AI analysis pending

6.6

—

9d ago

CVE-2026-76730

An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to…

An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication mechanisms and send unauthorized network traffic to the target device.

NVD description · AI analysis pending

6.5

—

9d ago

CVE-2026-76731

An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing…

An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain limited access to some data and to make limited changes within the affected component.

NVD description · AI analysis pending

6.5

—

9d ago

CVE-2026-76732

affected daemon of HPE Networking Instant ON: Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root…

A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met outside of the attacker's control.

NVD description · AI analysis pending

6.4

—

9d ago

CVE-2026-76733

A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative…

A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service, which resumes without manual intervention.

NVD description · AI analysis pending

4.9

—

9d ago

CVE-2026-76734

A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of…

A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service and to access some limited information within the affected component.

NVD description · AI analysis pending

4.8

—

9d ago

CVE-2026-76735

A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On

A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authenticated local attacker with high privileges to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Instant On, only if certain preconditions outside of the attacker's control are met.

NVD description · AI analysis pending

4.1

—

9d ago

CVE-2026-76736

A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On

A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow a low-privilege authenticated local attacker to interrupt the normal operation of the affected service.

NVD description · AI analysis pending

3.3

—

9d ago

CVE-2026-76737

An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On

An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of the affected service.

NVD description · AI analysis pending

3.0

—

9d ago

CVE-2026-76738

A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative…

A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service, which recovers without manual intervention.

NVD description · AI analysis pending

2.7

—

9d ago