CVE-2026-76677: Authorization Bypass Leading to Privilege Escalation in HPE Networking EdgeConnect SD-WAN Gateways
Published Sep 15, 2026
·Updated
A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways. Successful exploitation could allow a remote low-privileged authenticated user to achieve administrative privilege on the web-management interface leading to complete system compromise.
Affected Software
9 affected components
HPE Networking EdgeConnect SD-WAN Gateways
Arubanetworks Edgeconnect Sd-wan Orchestrator>=9.4.0<9.4.11
Arubanetworks Edgeconnect Sd-wan Orchestrator>=9.5.0<9.5.9
Arubanetworks Edgeconnect Sd-wan Orchestrator>=9.6.0<9.6.4
Arubanetworks Edgeconnect Sd-wan Orchestrator=9.7.0
HPE Edgeconnect Operating System>=9.4.0.0<9.4.9.0
HPE Edgeconnect Operating System>=9.5.0.0<9.5.9.0
HPE Edgeconnect Operating System>=9.6.0.0<9.6.4.0
HPE Edgeconnect Operating System=9.7.0.0
Event History
Sep 15, 2026
CVE Published
via MITRE·07:23 PM
Data Sourced
via MITRE·07:23 PM
DescriptionSeverity
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker with a low-privileged authenticated account on an affected EdgeConnect SD-WAN Gateway can exploit the vulnerable API.
2
What level of access could an attacker gain?
Successful exploitation can elevate the attacker to administrative privileges on the web-management interface, potentially resulting in complete system compromise.
3
Is unauthenticated exploitation possible?
The provided information describes exploitation by an authenticated low-privileged user; it does not indicate that unauthenticated attackers can exploit the issue.