Description
Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Published: 2026-09-29
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Buffer overflow vulnerabilities in the HPE Networking Instant ON APS interface allow an unauthenticated adjacent attacker to overwrite control data and execute arbitrary code on the device’s operating system.

Affected Systems

The affected product is Hewlett Packard Enterprise’s HPE Networking Instant ON, specifically the APS component. No version range is supplied in the CVE record, so any deployed APS instance may be impacted.

Risk and Exploitability

The vulnerability scores a CVSS of 9.6, signifying a high impact. EPSS data is not available, but the CVE is not listed in CISA KEV, indicating no current exploit activity on a large scale. Attackers likely exploit the vulnerability remotely via network connections to the affected interface, without requiring authentication.

Generated by OpenCVE AI on September 29, 2026 at 21:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any vendor‑supplied patch or upgrade to a fixed release of HPE Networking Instant ON APS.
  • Restrict unauthenticated network access to the APS management interface by applying firewall rules or placing the device on a dedicated management network.
  • Monitor logs for suspicious activity such as repeated access attempts or unexpected process executions, and investigate promptly.

Generated by OpenCVE AI on September 29, 2026 at 21:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) instant On
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) instant On

Tue, 29 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
CWE-787

Tue, 29 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Title Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking Instant ON APS
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Hewlett Packard Enterprise (hpe) Instant On
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-10-01T03:55:32.267Z

Reserved: 2026-08-19T16:12:51.872Z

Link: CVE-2026-76723

cve-icon Vulnrichment

Updated: 2026-09-30T20:37:39.280Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T20:17:24.327

Modified: 2026-10-01T04:18:19.613

Link: CVE-2026-76723

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T20:39:23Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-787

    Out-of-bounds Write