CVE-2026-76728CWE-918ssrf

CVE-2026-76728

High · published September 30, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-30T00:17Z
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 1%
    epss
  • 29 SEP 19:28Z
    Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs
    cvelistv5