CVE-2026-76729

Awaiting Analysis Awaiting Analysis - Queue

Format String Vulnerability in HPE Networking Instant ON APs

Publication date: 2026-09-29

Last updated on: 2026-10-01

Assigner: Hewlett Packard Enterprise (HPE)

Description

A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote code execution in the affected system function.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-76729

EUVD

EUVD-2026-89348

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	networking_instant_on	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-134	The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

Executive Summary

This is a format string vulnerability in the API endpoint of HPE Networking Instant ON APs. An authenticated remote attacker with high privileges can exploit it by sending modified input to cause memory corruption. This could lead to a denial-of-service condition or remote code execution in the affected system.

Detection Guidance

Detection requires checking for vulnerable HPE Networking Instant ON APs. Inspect network devices for the affected CPE hpe networking_instant_on. Verify API endpoint configurations for format string handling. No specific commands are provided in the CVE details.

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash the system, causing a denial-of-service. In severe cases, it may enable remote code execution, potentially giving the attacker control over the affected device.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches due to potential remote code execution or denial-of-service conditions, which may violate compliance requirements under GDPR and HIPAA. Unauthorized access to sensitive data could result in legal penalties or loss of certification.

Mitigation Strategies

Apply the latest security patches or updates provided by HPE for the affected HPE Networking Instant ON APs to address the format string vulnerability.

Hi! I’m here to help you understand CVE-2026-76729. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70