Description
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
Published: 2026-09-15
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Privilege Escalation via API Authorization Bypass
Action: Apply Patch
AI Analysis

Impact

A flaw in the EdgeConnect SD‑WAN Orchestrator API allows an authenticated user with low privileges to bypass authorization controls and gain full administrative rights. This privilege escalation can enable the attacker to alter network policies, inject traffic, or pivot to other services within the SD‑WAN environment, thereby compromising confidentiality, integrity, and availability of the network.

Affected Systems

Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways, specifically the Orchestrator API component. No version range is identified in the advisory data.

Risk and Exploitability

The CVSS score of 9.9 reflects a critical severity. The EPSS score is less than 1%, indicating a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but its potential to turn a low‑privileged, authenticated user into a full administrator remains a serious risk. The likely attack vector is through the network‑facing API, requiring only legitimate authentication credentials.

Generated by OpenCVE AI on September 17, 2026 at 07:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available HPE security updates or patches as soon as possible.
  • Remove unnecessary administrative privileges from user accounts and enforce the principle of least privilege.
  • Enable API audit logging and monitor for anomalous activity that indicates privilege escalation attempts.
  • Isolate the Orchestrator API to a trusted network segment and restrict inbound access to authorized clients.

Generated by OpenCVE AI on September 17, 2026 at 07:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) edgeconnect Sd-wan Gateways
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) edgeconnect Sd-wan Gateways

Thu, 17 Sep 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-285

Wed, 16 Sep 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-285

Tue, 15 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
Title Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Hewlett Packard Enterprise (hpe) Edgeconnect Sd-wan Gateways
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-09-15T19:25:15.453Z

Reserved: 2026-08-19T16:11:04.542Z

Link: CVE-2026-76669

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:17:48.627

Modified: 2026-09-16T19:20:52.817

Link: CVE-2026-76669

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T19:57:11Z

Weaknesses

No weakness.