HPE Instant On CVE-2026-76725

Exploitation requires network adjacency (AV:A): the attacker must reach the access point over a shared local or wireless network segment - for example as an associated Wi-Fi client, guest-network user, or a host already on the same LAN - and cannot trigger this directly across the public internet. Given that constraint, no further conditions apply: it is unauthenticated (PR:N), requires no user interaction (UI:N), and is low-complexity (AC:L) against affected HPE Networking Instant On access points running firmware Instant On ≤3.4.1.0. The primary limiting factors are (1) the adjacency requirement and (2) the affected-version boundary; devices already updated past 3.4.1.0 are not affected.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk case. The vendor CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 9.6 Critical) describes an unauthenticated, low-complexity authentication bypass in a management protocol that results in a scope change and full compromise of confidentiality, integrity, and availability - consistent with the description's claim of complete security-restriction bypass leading to remote code execution with elevated privileges. The one mitigating signal is the attack vector: AV:A (adjacent) means the attacker must be on the same local/Wi-Fi/L2 network segment rather than the open internet, which meaningfully narrows the exposure window compared to an AV:N flaw. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation or automated weaponization at this time; the criticality here is driven by intrinsic impact and ease of exploitation for an already-adjacent attacker, not by observed in-the-wild activity. Note the CWE is listed as N/A, so the precise weakness class (e.g. auth bypass CWE-287/CWE-288) is not formally categorized in the input.

An attacker who has gained a foothold on the same local or wireless network as an HPE Networking Instant On access point (e.g. a guest Wi-Fi client or a compromised LAN host) sends crafted traffic to the AP's management protocol, circumventing authentication without any credentials or user interaction. Because the flaw yields a complete bypass of security restrictions, the attacker escalates to remote code execution with elevated privileges on the AP itself. No public exploit code was identified at the time of analysis.