Description
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
Published: 2026-09-15
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows an authenticated user with low privileges to bypass authorization controls in the EdgeConnect SD‑WAN Or an attacker can elevate privileges to an administrative level, enabling full system compromise. The weakness stems from improper access control in the API layer and can lead to unauthorized configuration changes and data exposure.

Affected Systems

EdgeConnect SD‑WAN Gateways from Hewlett Packard Enterprise. Version details are not specified in API endpoint is susceptible.

Risk and Exploitability

The severity is high, reflected by a CVSS score of 9.9. Exploitation requires remote authenticated access to the API. The EPSS score indicates a very low probability of exploitation (< 1%), and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the risk remains significant for environments that expose the API to any remote users.

Generated by OpenCVE AI on September 21, 2026 at 21:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict network access to the Orchestrator API to trusted administrative hosts and enforce strong authentication
  • Enforce least privilege by configuring low‑privileged accounts with minimal permissions
  • Monitor and audit API calls for anomalous privilege‑elevation activity, and disable any unused API endpoints until a patch is applied
  • Apply vendor patch when an official fix is released

Generated by OpenCVE AI on September 21, 2026 at 21:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Arubanetworks
Arubanetworks edgeconnect Sd-wan Orchestrator
Hpe
Hpe edgeconnect Operating System
CPEs cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.7.0:*:*:*:*:*:*:*
cpe:2.3:o:hpe:edgeconnect_operating_system:*:*:*:*:*:*:*:*
cpe:2.3:o:hpe:edgeconnect_operating_system:9.7.0.0:*:*:*:*:*:*:*
Vendors & Products Arubanetworks
Arubanetworks edgeconnect Sd-wan Orchestrator
Hpe
Hpe edgeconnect Operating System

Mon, 21 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Sun, 20 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) edgeconnect Sd-wan Gateways
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) edgeconnect Sd-wan Gateways

Thu, 17 Sep 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 16 Sep 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Tue, 15 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
Title Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Arubanetworks Edgeconnect Sd-wan Orchestrator
Hewlett Packard Enterprise (hpe) Edgeconnect Sd-wan Gateways
Hpe Edgeconnect Operating System
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-09-21T20:00:54.012Z

Reserved: 2026-08-19T16:11:04.542Z

Link: CVE-2026-76670

cve-icon Vulnrichment

Updated: 2026-09-21T20:00:46.370Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:17:48.833

Modified: 2026-09-25T12:56:42.727

Link: CVE-2026-76670

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T22:00:10Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control