---
id: CVE-2026-76722
title: >-
  Uncontrolled Format string vulnerabilities exist in the affected interface of
  HPE Networking Instant ON APs that could allow an unauthenticated remote
  attacker to run arbitrary commands on the underlying host
summary: >-
  Uncontrolled Format string vulnerabilities exist in the affected interface of
  HPE Networking Instant ON APs that could allow an unauthenticated remote
  attacker to run arbitrary commands on the underlying host. Successful
  exploitation cou…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-134
vendor: Hewlett Packard Enterprise (HPE)
product: Instant ON
affected:
  - instant_on >= 0.0.0.0 <= 3.4.1.0
published: '2026-09-29'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T04:18:19.447'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76722'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US
    label: security-alert@hpe.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-30T18:28:12.131740Z'
ingestedAt: '2026-09-29T19:44:04.157Z'
epss: 0.0054
epssPercentile: 0.45207
---

## Overview

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.