Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

HPE Instant ON access points allow remote command execution

CVE-2026-76722 · published 19 days ago
Summary

The wireless access points in HPE's Instant ON line contain a flaw that lets anyone on the network send specially crafted data to make the device run commands. This could crash the device or let an attacker take control of it. Apply the latest firmware update from HPE as soon as possible to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hewlett packard enterprise (hpe) instant on <= 3.4.1.0
Original advisory text
Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs
Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code execution.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-134Use of Externally-Controlled Format String
Timeline
Published29 Sep 2026
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-76722 · NVD
CVE-2026-76722 · MITRE
Track software like this
Free during beta