This vulnerability in HPE Instant ON involves an authentication bypass in its API endpoint. An unauthenticated attacker could exploit this flaw to circumvent network access controls, contingent on specific preconditions outside the attacker's control. Successful exploitation leads to unauthorized access to restricted networks. The vulnerability is identified as CVE-2026-76726, with a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality, integrity, and availability. Affected versions include all releases up to and including 3.4.1.0.

An attacker who successfully exploits this vulnerability can bypass authentication mechanisms and gain unauthorized access to restricted network resources. This compromises confidentiality, integrity, and availability of the affected network environment. The attack requires no privileges and no user interaction but has a high attack complexity due to external preconditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints and monitor for suspicious activity related to network access control bypass attempts. Follow HPE's official advisories for updates on patches or mitigations.