Paper/Archive/CVE-2026-76675

CVE-2026-76675

Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways — Authenticated Command Injection Vulnerability Leads to Privilege Escalation in EdgeConnect SD-WAN Gateways

EPSS 1%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 73.4.734 × 2014.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to execute arbitrary commands on the underlying operating system leading to complete system compromise.

Affected

ProductAffectedFixed inSource

EdgeConnect SD-WAN Gateways9.7.0.0 – 9.7.0.0–CNA

EdgeConnect SD-WAN Gateways9.6.0.0 – 9.6.3.1–CNA

EdgeConnect SD-WAN Gateways9.5.0.0 – 9.5.8.1–CNA

EdgeConnect SD-WAN Gateways9.4.0.0 – 9.4.8.2–CNA

Scores by source

hpe (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US