Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

HPE Instant ON APs enable remote code execution

CVE-2026-76721 · published 19 days ago
Summary

A programming error in the networking interface of HPE Instant ON access points could let an unknown attacker run their own software on the device without logging in. If exploited, the attacker could gain full control of the access point and the network it connects to. Apply the latest firmware update from HPE as soon as possible and follow their guidance for securing the devices.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hewlett packard enterprise (hpe) instant on <= 3.4.1.0
Original advisory text
Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APs
Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published29 Sep 2026
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-76721 · NVD
CVE-2026-76721 · MITRE
Track software like this
Free during beta