CVE-2026-76670: Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must be authenticated to the EdgeConnect SD-WAN Orchestrator API with a low-privileged account. No user interaction is required.
What is the potential impact after exploitation?
An attacker can elevate privileges to those of an administrative user. This can lead to complete system compromise, including high-impact effects on confidentiality, integrity, and availability.
Is an unauthenticated attacker affected by this vulnerability?
The available information identifies low-privileged authenticated users as the required attacker position. It does not state that unauthenticated exploitation is possible.