CVE-2026-76722

CriticalCVSS 9.8/10Last modified Oct 1, 2026

Description

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-134

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 29, 2026
Last modified: Oct 1, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-767239.6Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacen CVE-2026-767249.6A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent a CVE-2026-767259.6A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent a CVE-2026-767268.1An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to by CVE-2026-767277.2Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote atta CVE-2026-767287.2A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to co CVE-2026-767296.6A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high pr CVE-2026-76734.7A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/jav CVE-2026-767306.5An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adja CVE-2026-767316.5An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to CVE-2026-767326.4A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation CVE-2026-767334.9A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with ad