by Kastro
Paper/Archive/CVE-2026-76670

CVE-2026-76670

Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways — Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator

EPSS 0.5%CVSS 9.9
critical.is priorityof 100
38
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 42.7.427 × 208.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.

Affected

ProductAffectedFixed inSource
EdgeConnect SD-WAN Gateways9.7.0 – 9.7.0–CNA
EdgeConnect SD-WAN Gateways9.6.0 – 9.6.3–CNA
EdgeConnect SD-WAN Gateways9.5.0 – 9.5.8–CNA
EdgeConnect SD-WAN Gateways9.4.0 – 9.4.10–CNA

Scores by source

hpe (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US