CVE-2026-76730: Improper PAPI Packet handling leads to unauthorized access in HPE Networking Instant ON APs
An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication mechanisms and send unauthorized network traffic to the target device.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
HPE Networking Instant On AP deployments are exposed where an attacker can reach the affected device from an adjacent network. The attack does not require prior authentication or user interaction.
What does an attacker need to exploit the issue?
An attacker needs adjacent-network access to the target AP and the ability to send PAPI traffic. No privileges or user interaction are required.
What could successful exploitation allow?
Successful exploitation can bypass certain existing authentication mechanisms and allow unauthorized network traffic to be sent to the target device. The provided impact data indicates integrity impact, with no stated confidentiality or availability impact.