CVE-2026-76729CWE-134

CVE-2026-76729

Medium · published September 30, 2026

CVSS v3.1
6.6
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote code execution in the affected system function.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00423 · 35.5th percentile
Weakness
CWE-134 · Use of Externally-Controlled Format String
Published
2026-09-30T00:17Z
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 0%
    epss
  • 29 SEP 19:28Z
    Authenticated Format String Vulnerability allows Memory Corruption in HPE Networking Instant ON API Endpoint
    cvelistv5