---
id: CVE-2026-76730
title: >-
  An authentication bypass vulnerability exists in the PAPI protocol of HPE
  Networking Instant ON APs that could allow an unauthenticated adjacent
  attacker to circumvent existing authentication controls
summary: >-
  An authentication bypass vulnerability exists in the PAPI protocol of HPE
  Networking Instant ON APs that could allow an unauthenticated adjacent
  attacker to circumvent existing authentication controls. Successful
  exploitation could allow…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
vendor: Hewlett Packard Enterprise (HPE)
product: Instant ON
affected:
  - instant_on >= 0.0.0.0 <= 3.4.1.0
published: '2026-09-29'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T21:39:02.570'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76730'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US
    label: security-alert@hpe.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-29T19:44:04.154Z'
---

## Overview

An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication mechanisms and send unauthorized network traffic to the target device.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.