CVE-2026-76675: Authenticated Command Injection Vulnerability Leads to Privilege Escalation in EdgeConnect SD-WAN Gateways
Published Sep 15, 2026
·Updated
A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Affected Software
9 affected components
EdgeConnect SD-WAN Gateways
Arubanetworks Edgeconnect Sd-wan Orchestrator>=9.4.0<9.4.11
Arubanetworks Edgeconnect Sd-wan Orchestrator>=9.5.0<9.5.9
Arubanetworks Edgeconnect Sd-wan Orchestrator>=9.6.0<9.6.4
Arubanetworks Edgeconnect Sd-wan Orchestrator=9.7.0
HPE Edgeconnect Operating System>=9.4.0.0<9.4.9.0
HPE Edgeconnect Operating System>=9.5.0.0<9.5.9.0
HPE Edgeconnect Operating System>=9.6.0.0<9.6.4.0
HPE Edgeconnect Operating System=9.7.0.0
Event History
Sep 15, 2026
CVE Published
via MITRE·07:23 PM
Data Sourced
via MITRE·07:23 PM
DescriptionSeverity
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An attacker must be authenticated to the gateway CLI and already hold high privileges. The issue is remotely exploitable and does not require user interaction.
2
What is the likely impact if exploitation succeeds?
Successful exploitation allows arbitrary command execution on the underlying operating system. This can result in complete compromise of the affected gateway, including confidentiality, integrity, and availability impacts.