HPE Instant On CVE-2026-76721

No special conditions in the base case - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) is possible against the affected interface of HPE Networking Instant On firmware version ≤3.4.1.0. The practical prerequisite is network reachability to the vulnerable interface: an attacker must be able to send traffic to the exposed management or service interface of the Instant On access point/switch. Exploitation is LIMITED by device version (fixed in a version above 3.4.1.0 per the HPE advisory) and by network exposure - devices whose vulnerable interface is not reachable from the attacker's network segment (e.g., not internet-exposed and segmented from untrusted LAN) reduce realistic risk. The exact interface, port, and protocol are not specified in the provided data and should be confirmed against HPE advisory hpesbnw05150en_us.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes the worst-case remotely reachable, unauthenticated, no-interaction condition, and the vendor-confirmed description matches it exactly: an unauthenticated remote attacker triggers a buffer overflow to execute arbitrary code as a privileged user on the underlying OS. Every impact metric is High and complexity is Low, so a single reachable request could yield privileged RCE. Signals that RAISE priority: HPE (the vendor) is the reporting source, a patch/advisory is referenced (hpesbnw05150en_us), and the affected component is a network-facing management/data-plane interface. Signals that TEMPER urgency: EPSS score is not provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is identified - so there is no confirmed active exploitation or automated weaponization yet. The absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from these inputs, but the combination of unauthenticated network RCE in a networking appliance historically attracts rapid attacker interest once details or patches are analyzed. CWE is listed as N/A in the feed although the tags and description clearly indicate a buffer overflow (memory-corruption class).

A remote attacker with network reachability to an internet- or LAN-exposed HPE Networking Instant On device (or its management interface) sends a crafted request to the vulnerable interface, overflowing a buffer and hijacking control flow. No credentials or user interaction are required, and successful exploitation yields arbitrary code execution as a privileged user on the underlying OS. No public exploit code has been identified at time of analysis.