CVE-2026-76724

Awaiting Analysis Awaiting Analysis - Queue

Command Injection in HPE Networking Instant ON APs

Publication date: 2026-09-29

Last updated on: 2026-10-01

Assigner: Hewlett Packard Enterprise (HPE)

Description

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-76724

EUVD

EUVD-2026-89343

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	networking_instant_on_aps	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a command injection vulnerability in the CLI of HPE Networking Instant ON APs. An unauthenticated attacker on the same network can send specially crafted packets to inject and execute arbitrary commands with high privileges on the underlying operating system.

Detection Guidance

Detection requires monitoring network traffic for malformed packets targeting HPE Networking Instant On APs. Use packet capture tools like tcpdump or Wireshark to inspect traffic for suspicious payloads. Check system logs on affected devices for unauthorized command execution attempts. Ensure APs are updated to the latest firmware to mitigate risks.

Impact Analysis

An attacker could take full control of the affected access point, steal sensitive data, modify configurations, or use it as a foothold to move deeper into your network. This could lead to data breaches, service disruption, or unauthorized access to connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate GDPR's data protection requirements or HIPAA's security rules. Organizations may face fines, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update the HPE Networking Instant ON APs to the latest firmware version to patch the command injection vulnerability. Isolate affected APs from untrusted networks and restrict access to the CLI interface.

Hi! I’m here to help you understand CVE-2026-76724. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70