Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

EdgeConnect SD-WAN Orchestrator lets low-privilege users become admins

CVE-2026-76670 · published 11 days ago
Summary

The management API in HPE EdgeConnect SD-WAN Orchestrator can be tricked by an authenticated user with limited rights to gain full administrative access. This could let an attacker take complete control of the system and its data. Apply the latest security update from HPE and restrict API access to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hewlett packard enterprise (hpe) edgeconnect sd-wan gateways <= 9.7.0
Original advisory text
Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
References
Severity
9.9 Critical
CVSS 3.1: 9.9 (MITRE)
Exploitation
EPSS <1%
Type
CWE-269Improper Privilege Management
Timeline
Published15 Sep 2026
Updated27 Sep 2026
First seen15 Sep 2026
Sources
CVE-2026-76670 · NVD
CVE-2026-76670 · MITRE
Track software like this
Free during beta