CVE WatchOct 1, 2026

CVE-2026-76722

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthentica

CVSS

9.8

Critical

EPSS

0.5%

p44

KEV

—

Exploit Today

0-100

Published: Sep 29, 2026 · Last modified: Oct 1, 2026 · CWE-134

EPSS · 30d

0.5%EPSS · 30 days0.5%

2026-09-302026-10-19

Technical description

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code execution.

Official references

support.hpe.comhttps://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-454528.3 HIG

17.7%

——5Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.5d CVE-2026-1020628.1 HIG

33.6%

——10An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server.6d CVE-2026-1019668.2 HIG

35.5%

——11A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener.6d CVE-2026-1019658.8 HIG

47.7%

——14An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.6d CVE-2026-945204.9 MED

48.0%

——14Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.6d CVE-2026-858427.8 HIG

23.3%

——7Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.5d