CVE-2026-76730CWE-287

CVE-2026-76730

Medium · published September 30, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication mechanisms and send unauthorized network traffic to the target device.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00208 · 10.3th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-30T00:17Z
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 0%
    epss
  • 29 SEP 19:28Z
    Improper PAPI Packet handling leads to unauthorized access in HPE Networking Instant ON APs
    cvelistv5