Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1179
Vulnerability from certfr_avis - Published: 2026-09-16 - Updated: 2026-09-16
De multiples vulnérabilités ont été découvertes dans les produits HPE Aruba Networking. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| HPE Aruba Networking | EdgeConnect SD-WAN Gateways | EdgeConnect SD-WAN Gateways versions 9.7.x.x antérieures à ECOS 9.7.1.0 | ||
| HPE Aruba Networking | EdgeConnect SD-WAN Orchestrator | EdgeConnect SD-WAN Orchestrator versions 9.7.x antérieures à Orchestrator 9.7.1 | ||
| HPE Aruba Networking | EdgeConnect SD-WAN Gateways | EdgeConnect SD-WAN Gateways versions 9.6.x.x antérieures à ECOS 9.6.4.0 | ||
| HPE Aruba Networking | EdgeConnect SD-WAN Gateways | EdgeConnect SD-WAN Gateways versions 9.5.x.x antérieures à ECOS 9.5.9.0 | ||
| HPE Aruba Networking | EdgeConnect SD-WAN Orchestrator | EdgeConnect SD-WAN Orchestrator versions 9.6.x antérieures à Orchestrator 9.6.4 | ||
| HPE Aruba Networking | EdgeConnect SD-WAN Gateways | EdgeConnect SD-WAN Gateways versions 9.4.x.x antérieures à ECOS 9.4.9.0 | ||
| HPE Aruba Networking | EdgeConnect SD-WAN Orchestrator | EdgeConnect SD-WAN Orchestrator versions 9.4.x antérieures à Orchestrator 9.4.11 | ||
| HPE Aruba Networking | EdgeConnect SD-WAN Orchestrator | EdgeConnect SD-WAN Orchestrator versions 9.5.x antérieures à Orchestrator 9.5.9 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "EdgeConnect SD-WAN Gateways versions 9.7.x.x ant\u00e9rieures \u00e0 ECOS 9.7.1.0",
"product": {
"name": "EdgeConnect SD-WAN Gateways",
"vendor": {
"name": "HPE Aruba Networking",
"scada": false
}
}
},
{
"description": "EdgeConnect SD-WAN Orchestrator versions 9.7.x ant\u00e9rieures \u00e0 Orchestrator 9.7.1",
"product": {
"name": "EdgeConnect SD-WAN Orchestrator",
"vendor": {
"name": "HPE Aruba Networking",
"scada": false
}
}
},
{
"description": "EdgeConnect SD-WAN Gateways versions 9.6.x.x ant\u00e9rieures \u00e0 ECOS 9.6.4.0",
"product": {
"name": "EdgeConnect SD-WAN Gateways",
"vendor": {
"name": "HPE Aruba Networking",
"scada": false
}
}
},
{
"description": "EdgeConnect SD-WAN Gateways versions 9.5.x.x ant\u00e9rieures \u00e0 ECOS 9.5.9.0",
"product": {
"name": "EdgeConnect SD-WAN Gateways",
"vendor": {
"name": "HPE Aruba Networking",
"scada": false
}
}
},
{
"description": "EdgeConnect SD-WAN Orchestrator versions 9.6.x ant\u00e9rieures \u00e0 Orchestrator 9.6.4",
"product": {
"name": "EdgeConnect SD-WAN Orchestrator",
"vendor": {
"name": "HPE Aruba Networking",
"scada": false
}
}
},
{
"description": "EdgeConnect SD-WAN Gateways versions 9.4.x.x ant\u00e9rieures \u00e0 ECOS 9.4.9.0",
"product": {
"name": "EdgeConnect SD-WAN Gateways",
"vendor": {
"name": "HPE Aruba Networking",
"scada": false
}
}
},
{
"description": "EdgeConnect SD-WAN Orchestrator versions 9.4.x ant\u00e9rieures \u00e0 Orchestrator 9.4.11",
"product": {
"name": "EdgeConnect SD-WAN Orchestrator",
"vendor": {
"name": "HPE Aruba Networking",
"scada": false
}
}
},
{
"description": "EdgeConnect SD-WAN Orchestrator versions 9.5.x ant\u00e9rieures \u00e0 Orchestrator 9.5.9",
"product": {
"name": "EdgeConnect SD-WAN Orchestrator",
"vendor": {
"name": "HPE Aruba Networking",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-76700",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76700"
},
{
"name": "CVE-2026-76702",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76702"
},
{
"name": "CVE-2026-76687",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76687"
},
{
"name": "CVE-2026-76705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76705"
},
{
"name": "CVE-2026-76693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76693"
},
{
"name": "CVE-2026-76675",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76675"
},
{
"name": "CVE-2026-76691",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76691"
},
{
"name": "CVE-2026-76684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76684"
},
{
"name": "CVE-2026-76692",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76692"
},
{
"name": "CVE-2026-76685",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76685"
},
{
"name": "CVE-2026-76695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76695"
},
{
"name": "CVE-2026-76670",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76670"
},
{
"name": "CVE-2026-76683",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76683"
},
{
"name": "CVE-2026-76678",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76678"
},
{
"name": "CVE-2026-76707",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76707"
},
{
"name": "CVE-2026-76674",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76674"
},
{
"name": "CVE-2026-76669",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76669"
},
{
"name": "CVE-2026-76690",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76690"
},
{
"name": "CVE-2026-76677",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76677"
},
{
"name": "CVE-2026-76703",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76703"
},
{
"name": "CVE-2026-76704",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76704"
},
{
"name": "CVE-2026-76673",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76673"
},
{
"name": "CVE-2024-32664",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32664"
},
{
"name": "CVE-2026-76698",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76698"
},
{
"name": "CVE-2026-76682",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76682"
},
{
"name": "CVE-2026-76696",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76696"
},
{
"name": "CVE-2026-76689",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76689"
},
{
"name": "CVE-2026-76681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76681"
},
{
"name": "CVE-2026-76672",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76672"
},
{
"name": "CVE-2026-76706",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76706"
},
{
"name": "CVE-2026-76686",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76686"
},
{
"name": "CVE-2026-76694",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76694"
},
{
"name": "CVE-2026-76688",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76688"
},
{
"name": "CVE-2026-76679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76679"
},
{
"name": "CVE-2026-76699",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76699"
},
{
"name": "CVE-2026-76701",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76701"
},
{
"name": "CVE-2026-76676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76676"
},
{
"name": "CVE-2026-76680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76680"
},
{
"name": "CVE-2026-76697",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76697"
}
],
"initial_release_date": "2026-09-16T00:00:00",
"last_revision_date": "2026-09-16T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1179",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-16T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits HPE Aruba Networking. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits HPE Aruba Networking",
"vendor_advisories": [
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 HPE Aruba Networking HPESBNW05135",
"url": "https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05135.txt"
}
]
}
CVE-2024-32664 (GCVE-0-2024-32664)
Vulnerability from cvelistv5 – Published: 2024-05-07 14:57 – Updated: 2024-08-02 02:13
VLAI
EPSS
VEX
Title
Suricata's base64 contains an out of bounds write
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, specially crafted traffic or datasets can cause a limited buffer overflow. This vulnerability is fixed in 7.0.5 and 6.0.19. Workarounds include not use rules with `base64_decode` keyword with `bytes` option with value 1, 2 or 5 and for 7.0.x, setting `app-layer.protocols.smtp.mime.body-md5` to false.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-07 18:13 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/311002baf… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/d5ffecf11… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:oisf:suricata:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "suricata",
"vendor": "oisf",
"versions": [
{
"lessThanOrEqual": "6.0.18",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:oisf:suricata:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "suricata",
"vendor": "oisf",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32664",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-07T18:13:57.659920Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:51:44.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:13:40.336Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-79vh-hpwq-3jh7",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-79vh-hpwq-3jh7"
},
{
"name": "https://github.com/OISF/suricata/commit/311002baf288a225f62cf18a90c5fdd294447379",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OISF/suricata/commit/311002baf288a225f62cf18a90c5fdd294447379"
},
{
"name": "https://github.com/OISF/suricata/commit/d5ffecf11ad2c6fe89265e518f5d7443caf26ba4",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OISF/suricata/commit/d5ffecf11ad2c6fe89265e518f5d7443caf26ba4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c= 6.0.18"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c= 7.0.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, specially crafted traffic or datasets can cause a limited buffer overflow. This vulnerability is fixed in 7.0.5 and 6.0.19. Workarounds include not use rules with `base64_decode` keyword with `bytes` option with value 1, 2 or 5 and for 7.0.x, setting `app-layer.protocols.smtp.mime.body-md5` to false."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-07T14:57:01.967Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-79vh-hpwq-3jh7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-79vh-hpwq-3jh7"
},
{
"name": "https://github.com/OISF/suricata/commit/311002baf288a225f62cf18a90c5fdd294447379",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/311002baf288a225f62cf18a90c5fdd294447379"
},
{
"name": "https://github.com/OISF/suricata/commit/d5ffecf11ad2c6fe89265e518f5d7443caf26ba4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/d5ffecf11ad2c6fe89265e518f5d7443caf26ba4"
}
],
"source": {
"advisory": "GHSA-79vh-hpwq-3jh7",
"discovery": "UNKNOWN"
},
"title": "Suricata\u0027s base64 contains an out of bounds write"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32664",
"datePublished": "2024-05-07T14:57:01.967Z",
"dateReserved": "2024-04-16T14:15:26.878Z",
"dateUpdated": "2024-08-02T02:13:40.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-76669 (GCVE-0-2026-76669)
Vulnerability from cvelistv5 – Published: 2026-09-15 19:23 – Updated: 2026-09-21 20:01
VLAI
EPSS
VEX
Title
Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator
Summary
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 20:01 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | EdgeConnect SD-WAN Gateways |
Affected:
9.7.0 , ≤ 9.7.0
(semver)
Affected: 9.6.0 , ≤ 9.6.3 (semver) Affected: 9.5.0 , ≤ 9.5.8 (semver) Affected: 9.4.0 , ≤ 9.4.10 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T20:01:26.297742Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:01:50.449Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "EdgeConnect SD-WAN Gateways",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "9.7.0",
"status": "affected",
"version": "9.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.6.3",
"status": "affected",
"version": "9.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.8",
"status": "affected",
"version": "9.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.10",
"status": "affected",
"version": "9.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Internal security research (HPE Networking)."
}
],
"descriptions": [
{
"lang": "en",
"value": "Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:25:15.453Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW05135",
"discovery": "INTERNAL"
},
"title": "Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2026-76669",
"datePublished": "2026-09-15T19:23:32.489Z",
"dateReserved": "2026-08-19T16:11:04.542Z",
"dateUpdated": "2026-09-21T20:01:50.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76670 (GCVE-0-2026-76670)
Vulnerability from cvelistv5 – Published: 2026-09-15 19:23 – Updated: 2026-09-21 20:00
VLAI
EPSS
VEX
Title
Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator
Summary
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 20:00 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | EdgeConnect SD-WAN Gateways |
Affected:
9.7.0 , ≤ 9.7.0
(semver)
Affected: 9.6.0 , ≤ 9.6.3 (semver) Affected: 9.5.0 , ≤ 9.5.8 (semver) Affected: 9.4.0 , ≤ 9.4.10 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76670",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T20:00:06.746905Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:00:54.012Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "EdgeConnect SD-WAN Gateways",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "9.7.0",
"status": "affected",
"version": "9.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.6.3",
"status": "affected",
"version": "9.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.8",
"status": "affected",
"version": "9.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.10",
"status": "affected",
"version": "9.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "This vulnerability was reported by Christopher Alejandro (Moroco) to the HPE Networking Bug Bounty program."
}
],
"descriptions": [
{
"lang": "en",
"value": "Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:23:33.196Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW05135",
"discovery": "INTERNAL"
},
"title": "Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2026-76670",
"datePublished": "2026-09-15T19:23:33.196Z",
"dateReserved": "2026-08-19T16:11:04.542Z",
"dateUpdated": "2026-09-21T20:00:54.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76672 (GCVE-0-2026-76672)
Vulnerability from cvelistv5 – Published: 2026-09-15 19:23 – Updated: 2026-09-20 00:39
VLAI
EPSS
VEX
Title
Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator
Summary
A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint. Successful exploitation could result in the disclosure of sensitive third-party API tokens and credentials, potentially enabling lateral movement to external security platforms.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-20 00:39 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | EdgeConnect SD-WAN Gateways |
Affected:
9.7.0 , ≤ 9.7.0
(semver)
Affected: 9.6.0 , ≤ 9.6.3 (semver) Affected: 9.5.0 , ≤ 9.5.8 (semver) Affected: 9.4.0 , ≤ 9.4.10 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76672",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-20T00:39:31.863126Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T00:39:36.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "EdgeConnect SD-WAN Gateways",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "9.7.0",
"status": "affected",
"version": "9.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.6.3",
"status": "affected",
"version": "9.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.8",
"status": "affected",
"version": "9.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.10",
"status": "affected",
"version": "9.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Internal security research (HPE Networking)."
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint. Successful exploitation could result in the disclosure of sensitive third-party API tokens and credentials, potentially enabling lateral movement to external security platforms."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:23:33.951Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW05135",
"discovery": "INTERNAL"
},
"title": "Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2026-76672",
"datePublished": "2026-09-15T19:23:33.951Z",
"dateReserved": "2026-08-19T16:11:04.542Z",
"dateUpdated": "2026-09-20T00:39:36.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76673 (GCVE-0-2026-76673)
Vulnerability from cvelistv5 – Published: 2026-09-15 19:23 – Updated: 2026-09-21 19:49
VLAI
EPSS
VEX
Title
Authentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN Orchestrator
Summary
Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the EdgeConnect SD-WAN Orchestrator host.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:49 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | EdgeConnect SD-WAN Gateways |
Affected:
9.7.0 , ≤ 9.7.0
(semver)
Affected: 9.6.0 , ≤ 9.6.3 (semver) Affected: 9.5.0 , ≤ 9.5.8 (semver) Affected: 9.4.0 , ≤ 9.4.10 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76673",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:49:18.298367Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:49:37.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "EdgeConnect SD-WAN Gateways",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "9.7.0",
"status": "affected",
"version": "9.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.6.3",
"status": "affected",
"version": "9.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.8",
"status": "affected",
"version": "9.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.10",
"status": "affected",
"version": "9.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Internal security research (HPE Networking)."
}
],
"descriptions": [
{
"lang": "en",
"value": "Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the EdgeConnect SD-WAN Orchestrator host."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:23:34.718Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW05135",
"discovery": "INTERNAL"
},
"title": "Authentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN Orchestrator",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2026-76673",
"datePublished": "2026-09-15T19:23:34.718Z",
"dateReserved": "2026-08-19T16:11:04.542Z",
"dateUpdated": "2026-09-21T19:49:37.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76674 (GCVE-0-2026-76674)
Vulnerability from cvelistv5 – Published: 2026-09-15 19:23 – Updated: 2026-09-21 19:59
VLAI
EPSS
VEX
Title
Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways
Summary
Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to execute arbitrary code. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:59 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | EdgeConnect SD-WAN Gateways |
Affected:
9.7.0.0 , ≤ 9.7.0.0
(semver)
Affected: 9.6.0.0 , ≤ 9.6.3.1 (semver) Affected: 9.5.0.0 , ≤ 9.5.8.1 (semver) Affected: 9.4.0.0 , ≤ 9.4.8.2 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:59:21.174909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:59:42.686Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "EdgeConnect SD-WAN Gateways",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "9.7.0.0",
"status": "affected",
"version": "9.7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.6.3.1",
"status": "affected",
"version": "9.6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.8.1",
"status": "affected",
"version": "9.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.8.2",
"status": "affected",
"version": "9.4.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Internal security research (HPE Networking)."
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to execute arbitrary code. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:23:35.574Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW05135",
"discovery": "INTERNAL"
},
"title": "Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2026-76674",
"datePublished": "2026-09-15T19:23:35.574Z",
"dateReserved": "2026-08-19T16:11:04.542Z",
"dateUpdated": "2026-09-21T19:59:42.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76675 (GCVE-0-2026-76675)
Vulnerability from cvelistv5 – Published: 2026-09-15 19:23 – Updated: 2026-09-21 19:52
VLAI
EPSS
VEX
Title
Authenticated Command Injection Vulnerability Leads to Privilege Escalation in EdgeConnect SD-WAN Gateways
Summary
A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:52 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | EdgeConnect SD-WAN Gateways |
Affected:
9.7.0.0 , ≤ 9.7.0.0
(semver)
Affected: 9.6.0.0 , ≤ 9.6.3.1 (semver) Affected: 9.5.0.0 , ≤ 9.5.8.1 (semver) Affected: 9.4.0.0 , ≤ 9.4.8.2 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76675",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:52:06.579169Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:52:26.418Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "EdgeConnect SD-WAN Gateways",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "9.7.0.0",
"status": "affected",
"version": "9.7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.6.3.1",
"status": "affected",
"version": "9.6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.8.1",
"status": "affected",
"version": "9.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.8.2",
"status": "affected",
"version": "9.4.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Internal security research (HPE Networking)."
}
],
"descriptions": [
{
"lang": "en",
"value": "A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:23:36.368Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW05135",
"discovery": "INTERNAL"
},
"title": "Authenticated Command Injection Vulnerability Leads to Privilege Escalation in EdgeConnect SD-WAN Gateways",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2026-76675",
"datePublished": "2026-09-15T19:23:36.368Z",
"dateReserved": "2026-08-19T16:11:18.067Z",
"dateUpdated": "2026-09-21T19:52:26.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76676 (GCVE-0-2026-76676)
Vulnerability from cvelistv5 – Published: 2026-09-15 19:23 – Updated: 2026-09-21 19:58
VLAI
EPSS
VEX
Title
Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in EdgeConnect SD-WAN Gateways
Summary
Buffer overflow vulnerabilities exist in the underlying operating system of EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to execute arbitrary code if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:58 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | EdgeConnect SD-WAN Gateways |
Affected:
9.7.0.0 , ≤ 9.7.0.0
(semver)
Affected: 9.6.0.0 , ≤ 9.6.3.1 (semver) Affected: 9.5.0.0 , ≤ 9.5.8.1 (semver) Affected: 9.4.0.0 , ≤ 9.4.8.2 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76676",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:58:36.796389Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:58:57.892Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "EdgeConnect SD-WAN Gateways",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "9.7.0.0",
"status": "affected",
"version": "9.7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.6.3.1",
"status": "affected",
"version": "9.6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.8.1",
"status": "affected",
"version": "9.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.8.2",
"status": "affected",
"version": "9.4.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Internal security research (HPE Networking)."
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow vulnerabilities exist in the underlying operating system of EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to execute arbitrary code if certain preconditions outside of the attacker\u0027s control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:23:37.201Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW05135",
"discovery": "INTERNAL"
},
"title": "Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in EdgeConnect SD-WAN Gateways",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2026-76676",
"datePublished": "2026-09-15T19:23:37.201Z",
"dateReserved": "2026-08-19T16:11:18.067Z",
"dateUpdated": "2026-09-21T19:58:57.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76677 (GCVE-0-2026-76677)
Vulnerability from cvelistv5 – Published: 2026-09-15 19:23 – Updated: 2026-09-21 19:53
VLAI
EPSS
VEX
Title
Authorization Bypass Leading to Privilege Escalation in HPE Networking EdgeConnect SD-WAN Gateways
Summary
A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways. Successful exploitation could allow a remote low-privileged authenticated user to achieve administrative privilege on the web-management interface leading to complete system compromise.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:52 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | EdgeConnect SD-WAN Gateways |
Affected:
9.7.0.0 , ≤ 9.7.0.0
(semver)
Affected: 9.6.0.0 , ≤ 9.6.3.1 (semver) Affected: 9.5.0.0 , ≤ 9.5.8.1 (semver) Affected: 9.4.0.0 , ≤ 9.4.8.2 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76677",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:52:51.220181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:53:09.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "EdgeConnect SD-WAN Gateways",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "9.7.0.0",
"status": "affected",
"version": "9.7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.6.3.1",
"status": "affected",
"version": "9.6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.8.1",
"status": "affected",
"version": "9.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.8.2",
"status": "affected",
"version": "9.4.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Internal security research (HPE Networking)."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways. Successful exploitation could allow a remote low-privileged authenticated user to achieve administrative privilege on the web-management interface leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:23:37.869Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW05135",
"discovery": "INTERNAL"
},
"title": "Authorization Bypass Leading to Privilege Escalation in HPE Networking EdgeConnect SD-WAN Gateways",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2026-76677",
"datePublished": "2026-09-15T19:23:37.869Z",
"dateReserved": "2026-08-19T16:11:18.067Z",
"dateUpdated": "2026-09-21T19:53:09.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76678 (GCVE-0-2026-76678)
Vulnerability from cvelistv5 – Published: 2026-09-15 19:23 – Updated: 2026-09-21 19:53
VLAI
EPSS
VEX
Title
Authenticated Command Injection Vulnerability leads to Remote Code Execution in EdgeConnect SD-WAN Gateways
Summary
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:53 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | EdgeConnect SD-WAN Gateways |
Affected:
9.7.0.0 , ≤ 9.7.0.0
(semver)
Affected: 9.6.0.0 , ≤ 9.6.3.1 (semver) Affected: 9.5.0.0 , ≤ 9.5.8.1 (semver) Affected: 9.4.0.0 , ≤ 9.4.8.2 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76678",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:53:28.226364Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:53:47.355Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "EdgeConnect SD-WAN Gateways",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "9.7.0.0",
"status": "affected",
"version": "9.7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.6.3.1",
"status": "affected",
"version": "9.6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.8.1",
"status": "affected",
"version": "9.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.8.2",
"status": "affected",
"version": "9.4.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Internal security research (HPE Networking)."
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:23:38.640Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW05135",
"discovery": "INTERNAL"
},
"title": "Authenticated Command Injection Vulnerability leads to Remote Code Execution in EdgeConnect SD-WAN Gateways",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2026-76678",
"datePublished": "2026-09-15T19:23:38.640Z",
"dateReserved": "2026-08-19T16:11:18.067Z",
"dateUpdated": "2026-09-21T19:53:47.355Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…