HPE Instant On EUVD-2026-89347

Exploitation requires an authenticated remote attacker holding HIGH privileges (administrative access) on the HPE Networking Instant ON management/API interface (PR:H), targeting the vulnerable API endpoint on devices running Instant On firmware version ≤3.4.1.0. No end-user interaction is required (UI:N) and the vector is network-reachable (AV:N). The dominant limiting factor is the prerequisite of existing high-privilege credentials - this is a post-authentication privilege-to-RCE pivot, not an unauthenticated compromise, which substantially narrows realistic attackers to those who have already breached or been granted AP administration.

The CVSS 3.1 score of 7.2 (High) reflects a network-reachable flaw (AV:N) with low attack complexity (AC:L) and full CIA impact (C:H/I:H/A:H), but it is gated by PR:H - the attacker must already hold high/administrative privileges on the Instant ON management interface, which is the single most limiting factor. There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the intelligence, so this is best characterized as no public exploit identified at time of analysis. In SSVC terms the exploitation state is 'none', technical impact is 'total' (SSRF pivoting to arbitrary command execution as a privileged OS user), but automatability is low because exploitation presupposes prior high-privilege authentication rather than anonymous mass scanning. This is a genuinely serious post-authentication escalation-to-RCE primitive, yet the PR:H prerequisite keeps real-world risk below that of an unauthenticated network RCE; it is a real priority for environments where AP admin credentials could be phished, shared, or compromised, rather than a broadly wormable issue. No signals conflict - CVSS network vector, the description ('authenticated remote attacker with high privileges'), and the vendor advisory are mutually consistent.

An attacker who has already obtained high-privilege administrative access to an HPE Networking Instant ON access point (e.g., via credential theft, reuse, or an insider) sends a crafted request to the vulnerable API endpoint, coercing the device to make attacker-controlled server-side requests. The SSRF is leveraged to reach internal services and ultimately execute arbitrary commands as a privileged user on the AP's underlying operating system. No public proof-of-concept exploit was provided in the available intelligence.