CVE-2026-76680: Authenticated Server-Side Request Forgery Vulnerabilities Leading to Information Disclosure in EdgeConnect SD-WAN Orchestrator
Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery (SSRF) attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information beyond what is authorized by the user's existing privilege level.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments of Juniper Networks EdgeConnect SD-WAN Orchestrator are exposed if a remote attacker can authenticate to its API with a low-privileged account. The vulnerability is network-reachable and does not require user interaction.
What access does an attacker need?
An attacker needs valid low-privilege authentication to the EdgeConnect SD-WAN Orchestrator API. No additional user interaction is required for exploitation.
What could an attacker obtain through exploitation?
Successful SSRF exploitation can let the attacker enumerate information about the internal structure of the Orchestrator host. This may disclose sensitive information beyond the permissions of the compromised low-privilege account.