Description
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
Published: 2026-09-15
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Privilege Escalation via API Authorization Bypass
Action: Apply Patch
AI Analysis

Impact

A flaw in the EdgeConnect SD‑WAN Orchestrator API allows a remote low‑privileged authenticated user to bypass authorization controls and gain administrative privileges, which can lead to complete system compromise by granting the attacker full control over the system.

Affected Systems

Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways, specifically the Orchestrator API component. No version range is identified in the advisory data.

Risk and Exploitability

The CVSS score of 9.9 reflects a critical severity. The EPSS score is less than 1%, indicating a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but its potential to turn a low‑privileged, authenticated user into a full administrator remains a serious risk. The likely attack vector is inferred to be through the network‑facing API, requiring only legitimate authentication credentials.

Generated by OpenCVE AI on September 21, 2026 at 21:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available HPE security updates or patches as soon as possible.
  • Remove unnecessary administrative privileges from user accounts and enforce the principle of least privilege.
  • Enable API audit logging and monitor for anomalous activity that indicates privilege escalation attempts.
  • Isolate the Orchestrator API to a trusted network segment and restrict inbound access to authorized clients.

Generated by OpenCVE AI on September 21, 2026 at 21:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Arubanetworks
Arubanetworks edgeconnect Sd-wan Orchestrator
Hpe
Hpe edgeconnect Operating System
CPEs cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.7.0:*:*:*:*:*:*:*
cpe:2.3:o:hpe:edgeconnect_operating_system:*:*:*:*:*:*:*:*
cpe:2.3:o:hpe:edgeconnect_operating_system:9.7.0.0:*:*:*:*:*:*:*
Vendors & Products Arubanetworks
Arubanetworks edgeconnect Sd-wan Orchestrator
Hpe
Hpe edgeconnect Operating System

Mon, 21 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Sun, 20 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-285

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) edgeconnect Sd-wan Gateways
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) edgeconnect Sd-wan Gateways

Thu, 17 Sep 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-285

Wed, 16 Sep 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-285

Tue, 15 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
Title Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Arubanetworks Edgeconnect Sd-wan Orchestrator
Hewlett Packard Enterprise (hpe) Edgeconnect Sd-wan Gateways
Hpe Edgeconnect Operating System
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-09-21T20:01:50.449Z

Reserved: 2026-08-19T16:11:04.542Z

Link: CVE-2026-76669

cve-icon Vulnrichment

Updated: 2026-09-21T20:01:42.652Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:17:48.627

Modified: 2026-09-25T12:56:46.377

Link: CVE-2026-76669

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T22:00:10Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-285

    Improper Authorization