CVE-2026-76728: Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs
Published Sep 29, 2026
·Updated
A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
Affected Software
1 affected component
HPE Networking Instant On APs
Event History
Sep 29, 2026
CVE Published
via MITRE·07:28 PM
Data Sourced
via MITRE·07:28 PM
DescriptionSeverity
Data Sourced
via NVD·08:17 PM
DescriptionSeverity
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated to the Instant On AP API and have high privileges. The issue is remotely exploitable and does not require user interaction.
2
What could successful exploitation allow?
An attacker could use server-side request forgery through the affected API endpoint and execute arbitrary commands as a privileged user on the underlying operating system.