HPE disclosed 18 vulnerabilities in Instant On APs running 3.4.1.0 and earlier, including 10 named CVEs that can lead to code execution, command execution, authentication bypass, SSRF, or denial of service. HPE says the fixes arrive in version 3.4.2.0.
The catch is how those fixes land: only APs managed through the Instant On cloud portal get corrected automatically. Offline, standalone, or end-of-life APs can stay vulnerable even after a normal update cycle, so the exposure is partly about fleet coverage, not just software version.
For operators with mixed or unmanaged APs, the remaining risk sits on devices outside the cloud-managed path, and management-plane flaws can matter as much as wireless disruption. The report does not settle how many exposed APs are not enrolled in Instant On management.