HPE Instant On EUVD-2026-89348

Requires the attacker to already hold HIGH administrative privileges (PR:H) on the HPE Instant On AP management API - this is an authenticated flaw, not remote-unauthenticated. Exploitation targets a specific vulnerable API endpoint reachable over the network (AV:N) and depends on crafting format-string input that induces memory corruption; the vendor rates it AC:H, indicating reliable weaponization (especially for RCE versus a simple crash) needs memory-layout knowledge or repeated attempts. Affected: Instant On firmware ≤3.4.1.0; no user interaction is required. The high-privilege prerequisite is the dominant limiting factor - an attacker must first compromise an admin account or chain another flaw.

This is a genuine-but-constrained issue rather than a top-tier emergency. The vendor (HPE) CVSS vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H yields 6.6 (Medium), and the two metrics that most limit real-world risk are PR:H (attacker must already hold high/administrative privileges on the Instant On management API) and AC:H (exploitation is not straightforward - a format-string primitive typically requires memory-layout knowledge or repeated attempts to weaponize reliably). The full C:H/I:H/A:H impact reflects the RCE ceiling once triggered, which is why the score is not lower. No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation status is: no public exploit identified at time of analysis. There is no conflict between the vector and the description - both agree on network-reachable, privilege-requiring, high-complexity access. The main caveat is that the CWE is listed as N/A in the input; the description ('format string vulnerability ... memory corruption') clearly maps to CWE-134, which the metadata omits. Net: prioritize patching for internet-exposed or multi-tenant management deployments, but the PR:H gate means an attacker already needs admin-equivalent access, sharply narrowing realistic exploitation.

An attacker who has already obtained high-privilege (administrative) access to the HPE Instant On management API - for example via stolen operator credentials or a chained privilege escalation - submits a crafted value containing format-string specifiers to a vulnerable API endpoint. The malformed input is processed unsafely, corrupting memory to crash the AP function (denial of service) or, with more effort given the high attack complexity, achieve remote code execution. No public POC is available at time of analysis.