HPE Instant On CVE-2026-76736

Requires local access to the underlying operating system of an HPE Networking Instant On device with low-privilege authenticated credentials (AV:L/PR:L); it is not remotely exploitable and needs no user interaction. Exploitation is limited to interrupting normal operation of a single affected service (A:L, scope unchanged) with no confidentiality or integrity impact. Affected builds are Instant On versions up to and including 3.4.1.0; the pre-existing authenticated local foothold is the primary limiting factor on realistic risk.

All signals point to a genuinely low-priority issue despite it being a buffer overflow. The vendor-supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) scores only 3.3 and describes a local, low-privilege-authenticated attacker who can merely interrupt normal operation of the affected service - no confidentiality or integrity impact (C:N/I:N), and only limited availability impact (A:L, i.e. a partial or temporary service disruption, not a full crash or takeover). No EPSS score, no CISA KEV listing, and no public POC were provided, so the real-world exploitation likelihood is unquantified but there is no evidence of exploitation: no public exploit identified at time of analysis. The local attack vector plus required authentication (PR:L) sharply constrains reach - the attacker must already have a foothold with credentials on the underlying operating system of the device. There is no conflict between the CVSS vector and the description; both consistently indicate a local, authenticated, availability-only weakness. This is a low-CVSS, low-real-risk issue that warrants routine patching rather than emergency response.

An attacker who already holds low-privilege authenticated access to the underlying OS of an HPE Networking Instant On device supplies malformed input that overflows a buffer in a local service, causing that service to malfunction or restart. The impact is limited to disrupting normal operation of that service (A:L); no code execution, data disclosure, or integrity compromise is claimed. No public exploit code has been identified.