Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

EdgeConnect SD-WAN Orchestrator lets low-level users become admins

CVE-2026-76669 · published 11 days ago
Summary

The API in HPE EdgeConnect SD-WAN Orchestrator can be tricked by an authenticated user with limited rights to gain full administrator access. This could let an attacker take control of the entire system and access sensitive data. Apply the latest updates from HPE and review user permissions to reduce the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hewlett packard enterprise (hpe) edgeconnect sd-wan gateways <= 9.7.0
Original advisory text
Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
References
Severity
9.9 Critical
CVSS 3.1: 9.9 (MITRE)
Exploitation
EPSS <1%
Type
CWE-269Improper Privilege Management
Timeline
Published15 Sep 2026
Updated27 Sep 2026
First seen15 Sep 2026
Sources
CVE-2026-76669 · NVD
CVE-2026-76669 · MITRE
Track software like this
Free during beta