by Kastro
Paper/Archive/CVE-2026-76672

CVE-2026-76672

Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways — Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator

EPSS 0.5%CVSS 9.9
critical.is priorityof 100
39
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 44.9.449 × 209.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint. Successful exploitation could result in the disclosure of sensitive third-party API tokens and credentials, potentially enabling lateral movement to external security platforms.

Affected

ProductAffectedFixed inSource
EdgeConnect SD-WAN Gateways9.7.0 – 9.7.0–CNA
EdgeConnect SD-WAN Gateways9.6.0 – 9.6.3–CNA
EdgeConnect SD-WAN Gateways9.5.0 – 9.5.8–CNA
EdgeConnect SD-WAN Gateways9.4.0 – 9.4.10–CNA

Scores by source

hpe (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US