HPE Instant On: 18 Vulnerabilities Disclosed, Including Critical RCE Flaws
HPE Networking Instant On faces a critical security event with 18 vulnerabilities disclosed, ranging from low to critical severity, including remote code execution flaws.
Key findings
- 18 vulnerabilities disclosed for HPE Networking Instant On on September 29, 2026.
- Flaws include critical buffer overflows, command injections, and authentication bypasses.
- CVSS scores range from Low to Critical (up to 9.8).
- Vulnerabilities affect API endpoints, CLI, and underlying OS functions.
- Potential impacts include denial-of-service and remote code execution.
On September 29, 2026, a significant batch of 18 vulnerabilities was disclosed for HPE Networking Instant On products. These vulnerabilities, all disclosed on the same day, range in severity from Low to Critical, with a notable cluster of high-impact flaws. The disclosures highlight a range of security weaknesses, including buffer overflows, command injections, authentication bypasses, and information disclosures, underscoring the need for prompt attention from administrators of affected HPE devices.
Several vulnerabilities center on buffer overflows and memory corruption. CVE-2026-76738, CVE-2026-76736, CVE-2026-76735, and CVE-2026-76723 all involve buffer overflow issues, with some allowing for denial-of-service conditions and others potentially leading to remote code execution. CVE-2026-76721, also a buffer overflow, explicitly states the possibility of executing arbitrary code as a privileged user.
Command injection and format string vulnerabilities represent another significant theme. CVE-2026-76732 points to a local privilege escalation flaw, while CVE-2026-76729, a format string vulnerability, could lead to denial-of-service or remote code execution. More critically, CVE-2026-76727 and CVE-2026-76724 allow authenticated and unauthenticated attackers, respectively, to execute arbitrary commands with privileged user rights. CVE-2026-76722, an uncontrolled format string vulnerability, also carries the risk of arbitrary command execution.
Authentication bypass and path traversal vulnerabilities were also disclosed. CVE-2026-76737 describes a path traversal flaw in the CLI, allowing modification of system files. Several CVEs, including CVE-2026-76731, CVE-2026-76730, and CVE-2026-76726, detail authentication bypasses in various components like the captive portal and API endpoints, with CVE-2026-7625 and CVE-2026-7623 allowing unauthenticated adjacent attackers to bypass security controls and potentially achieve remote code execution. CVE-2026-76728, a server-side request forgery (SSRF) vulnerability, allows an authenticated attacker to execute arbitrary commands as a privileged user.
The batch includes critical vulnerabilities with CVSS scores as high as 9.8, such as CVE-2026-76722 and CVE-2026-76721, which could allow unauthenticated remote attackers to execute arbitrary code. CVE-2026-76725, CVE-2026-76724, and CVE-2026-76723 also carry critical ratings, highlighting severe risks including remote code execution and complete bypass of security restrictions.
Impacts range from denial-of-service conditions, as seen in CVE-2026-76738, CVE-2026-76736, and CVE-2026-76735, to sensitive information disclosure (CVE-2026-76735) and the potential for full system compromise through remote code execution. The vulnerabilities affect various components, including API endpoints, command-line interfaces, captive portals, and underlying operating system functions.
HPE has released advisories detailing these vulnerabilities. Users are strongly recommended to consult HPE's official security bulletins and apply any available patches or firmware updates to mitigate these risks. The wide range of severities and attack vectors necessitates a thorough review of the security posture for all deployed HPE Networking Instant On devices.
The coordinated disclosure of these 18 vulnerabilities on a single day emphasizes the importance of timely patching and security diligence for HPE Networking Instant On users. The presence of critical flaws, including those allowing unauthenticated remote code execution, demands immediate attention to prevent potential exploitation and maintain the integrity of network infrastructure.
The vulnerabilities disclosed include: CVE-2026-76738, CVE-2026-76737, CVE-2026-76736, CVE-2026-76735, CVE-2026-76734, CVE-2026-76733, CVE-2026-76732, CVE-2026-76731, CVE-2026-76730, CVE-2026-76729, CVE-2026-76728, CVE-2026-76727, CVE-2026-76726, CVE-2026-76725, CVE-2026-76724, CVE-2026-76723, CVE-2026-76722, CVE-2026-76721.