Description
Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
Published: 2026-09-29
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A buffer overflow exists in the interface of HPE Networking Instant ON that can be triggered by an unauthenticated remote attacker. The flaw allows arbitrary code to run with privileged rights on the underlying operating system, potentially giving full system compromise, loss of confidentiality, integrity, and availability.

Affected Systems

Hewlett Packard Enterprise Instant ON devices are affected. No specific firmware or software versions are disclosed; any deployed Instant ON product could be vulnerable.

Risk and Exploitability

The CVSS score of 9.8 assigns this vulnerability a Critical rating. EPSS is not available, so the exact exploitation probability is unknown, but the lack of a KEV listing indicates no publicly known exploit has been reported yet. Based on the description, the likely attack vector is over‑the‑network via the exposed interface, and no authentication is required.

Generated by OpenCVE AI on September 29, 2026 at 21:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update HPE Instant ON firmware to the latest version that includes the patch for the buffer overflow flaw.
  • Configure the device to restrict access to the vulnerable interface, limiting it to trusted internal networks or disallowing it entirely if not needed.
  • Apply network segmentation or firewall rules to block untrusted hosts from reaching the vulnerable service, thereby reducing the attack surface.

Generated by OpenCVE AI on September 29, 2026 at 21:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) instant On
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) instant On

Tue, 29 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-787

Tue, 29 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
Title Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APs
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Hewlett Packard Enterprise (hpe) Instant On
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-09-30T20:11:06.823Z

Reserved: 2026-08-19T16:12:51.872Z

Link: CVE-2026-76721

cve-icon Vulnrichment

Updated: 2026-09-30T18:28:26.742Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T20:17:24.073

Modified: 2026-09-30T21:17:13.573

Link: CVE-2026-76721

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T20:39:27Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-787

    Out-of-bounds Write