- Critical 9.6
CVE-2026-76724
A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
Scores
The facts
- Published
- 29 September 2026
- Last changed
- 1 October 2026
- NVD status
- Awaiting Analysis
- Severity
- Critical, CVSS 9.6 out of 10 (version 3.1)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- Known exploited
- Not in the CISA Known Exploited Vulnerabilities catalogue in this build.
- EPSS
- 1.0% chance of exploitation activity in the next 30 days (percentile 63).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.