CVE-2026-76737

Awaiting Analysis Awaiting Analysis - Queue

Authenticated Path Traversal in HPE Networking Instant On CLI

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: Hewlett Packard Enterprise (HPE)

Description

An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of the affected service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-76737

EUVD

EUVD-2026-89356

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	networking_instant_on	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is an authenticated path traversal vulnerability in HPE Networking Instant On's command line interface. It allows an attacker with admin access to modify certain files on the operating system and disrupt the service's normal operation.

Detection Guidance

This vulnerability requires authenticated administrative access to exploit. Detection should focus on monitoring for unauthorized file modifications or service disruptions by administrative users. Check system logs for unusual administrative actions and verify file integrity of critical system files.

Impact Analysis

An attacker could alter system files, causing service disruptions or instability. Since admin access is required, the impact is limited to users with such privileges.

Compliance Impact

This vulnerability allows an authenticated attacker with administrative access to modify files on the underlying operating system, which could potentially lead to unauthorized data access or service disruption. Such capabilities may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by compromising data integrity or confidentiality.

Mitigation Strategies

Restrict administrative access to the HPE Networking Instant On CLI to prevent unauthorized use. Monitor system logs for unusual file modifications or service interruptions. Apply any vendor-provided patches or updates as soon as they become available.

Hi! I’m here to help you understand CVE-2026-76737. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70