Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-76721, CVE-2026-76722, CVE-2026-76723, CVE-2026-76724, CVE-2026-76725 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-29 |
| Vendor | HPE (Aruba) |
| Product | HPE Networking Instant On access points |
| CVSS Score | 9.8 (critical) — highest of the five |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
HPE bulletin HPESBNW05150 covers five vulnerabilities in HPE Networking Instant On access points:
| CVE | Type | Attacker position | CVSS |
|---|---|---|---|
| CVE-2026-76721 | Buffer overflow — arbitrary code execution as a privileged user | Remote, unauthenticated | 9.8 |
| CVE-2026-76722 | Uncontrolled format string — arbitrary command execution | Remote, unauthenticated | 9.8 |
| CVE-2026-76723 | Buffer overflows — remote code execution | Adjacent network, unauthenticated | 9.6 |
| CVE-2026-76724 | Command injection in the CLI via crafted packets | Adjacent network, unauthenticated | 9.6 |
| CVE-2026-76725 | Management protocol authentication bypass, potentially leading to privileged RCE | Adjacent network, unauthenticated | 9.6 |
Required Actions
Update the firmware of all HPE Networking Instant On access points to the fixed version listed in HPE bulletin HPESBNW05150. Until the update is applied, make sure AP management is not reachable from the internet or guest networks, and isolate guest Wi-Fi from the internal network.
Who Is Affected?
Organizations running HPE Networking Instant On (formerly Aruba Instant On) access points — typically small and mid-sized businesses, branch offices and retail locations. Check the Instant On portal for the firmware version of every site.
Sources
- HPE Security Bulletin HPESBNW05150
- NVD - CVE-2026-76721
- NVD - CVE-2026-76722
- NVD - CVE-2026-76723
- NVD - CVE-2026-76724
- NVD - CVE-2026-76725
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
