---
cve: "CVE-2026-76722"
severity: "CRITICAL"
cvss: 9.8
epss: "0.5%"
vendor: "Hewlett Packard Enterprise (HPE)"
kev: false
exploited: false
published: "2026-09-29 19:28:34"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-20T08:21:09+02:00"
---

# CVE-2026-76722

> 9.8 CRITICAL

## Beschreibung

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code execution.

## CNA-Record (Kanon, cvelistV5)

- CNA: **hpe**
- State: PUBLISHED
- Stand: 2026-10-01 03:55:31
- CNA-CVSS: **9.8** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-134** — Use of Externally-Controlled Format String
  The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

## Angriffsmuster (CAPEC)

- [CAPEC-67 — String Format Overflow in syslog()](https://capec.mitre.org/data/definitions/67.html) _(Severity: Very High)_
- [CAPEC-135 — Format String Injection](https://capec.mitre.org/data/definitions/135.html) _(Severity: High)_

## Referenzen

- <https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-76722/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_