CVE-2026-76669 PUBLISHED

Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator

Assigner: hpe
Reserved: 19.08.2026 Published: 15.09.2026 Updated: 15.09.2026

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.9

Product Status

Vendor Hewlett Packard Enterprise (HPE)
Product EdgeConnect SD-WAN Gateways
Versions Default: affected
  • affected from 9.7.0 to 9.7.0 (incl.)
  • affected from 9.6.0 to 9.6.3 (incl.)
  • affected from 9.5.0 to 9.5.8 (incl.)
  • affected from 9.4.0 to 9.4.10 (incl.)

Credits

  • Internal security research (HPE Networking). reporter

References