CVE-2026-76678

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system.

Score

CVSS 3.1 8.8 High

Status

Analyzed - security-alert@hpe.com

Published

2026-09-15

Last modified

2026-09-21

Weaknesses

CWE-269

Affected products

• Edgeconnect Sd-wan Orchestrator (Arubanetworks)
• Edgeconnect Sd-wan Gateways (Hewlett Packard Enterprise Hpe)
• Edgeconnect Operating System (Hpe)

References

• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US