CVE-2026-76724

CriticalCVSS 9.6/10Last modified Oct 1, 2026

Description

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Hewlett Packard Enterprise (HPE)Instant ON>= 0.0.0.0, <= 3.4.1.0

References

Timeline

Published
Sep 29, 2026
Last modified
Oct 1, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-767259.6A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent aCVE-2026-767268.1An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to byCVE-2026-767277.2Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attaCVE-2026-767287.2A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to coCVE-2026-767296.6A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high prCVE-2026-76734.7A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/javCVE-2026-767306.5An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjaCVE-2026-767316.5An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to CVE-2026-767326.4A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation CVE-2026-767334.9A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with adCVE-2026-767344.8A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to cCVE-2026-767354.1A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploita
CVE-2026-76724: Critical severity, CVSS 9.6 | Vulnix