Description
Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the EdgeConnect SD-WAN Orchestrator host.
Published: 2026-09-15
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation to Full System Compromise
Action: Immediate Patch
AI Analysis

Impact

The vulnerability lies in the API of the EdgeConnect SD‑WAN Orchestrator, allowing an unauthenticated remote actor to bypass authentication controls. Successful exploitation would grant administrative privileges, effectively giving an attacker complete control over the orchestrator host. This flaw is categorized as improper authentication per CWE-287.

Affected Systems

Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways are affected. No specific version information is provided in the advisory, so all deployed instances should be considered vulnerable until a vendor update is applied.

Risk and Exploitability

With a CVSS score of 9.8 the vulnerability is highly severe. The EPSS score is < 1%, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is remote access via the exposed API, where an attacker can send crafted requests without authentication. The exploitation requires network reachability to the API endpoint and does not require any local privileges.

Generated by OpenCVE AI on September 20, 2026 at 12:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security update for EdgeConnect SD‑WAN Orchestrator as released by HPE
  • Restrict network access to the API endpoints so only trusted administrative hosts can reach them
  • Disable services that do not require authentication

Generated by OpenCVE AI on September 20, 2026 at 12:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Arubanetworks
Arubanetworks edgeconnect Sd-wan Orchestrator
Hpe
Hpe edgeconnect Operating System
CPEs cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.7.0:*:*:*:*:*:*:*
cpe:2.3:o:hpe:edgeconnect_operating_system:*:*:*:*:*:*:*:*
cpe:2.3:o:hpe:edgeconnect_operating_system:9.7.0.0:*:*:*:*:*:*:*
Vendors & Products Arubanetworks
Arubanetworks edgeconnect Sd-wan Orchestrator
Hpe
Hpe edgeconnect Operating System

Mon, 21 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) edgeconnect Sd-wan Gateways
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) edgeconnect Sd-wan Gateways

Thu, 17 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Tue, 15 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Tue, 15 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the EdgeConnect SD-WAN Orchestrator host.
Title Authentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN Orchestrator
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Arubanetworks Edgeconnect Sd-wan Orchestrator
Hewlett Packard Enterprise (hpe) Edgeconnect Sd-wan Gateways
Hpe Edgeconnect Operating System
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-09-21T19:49:37.874Z

Reserved: 2026-08-19T16:11:04.542Z

Link: CVE-2026-76673

cve-icon Vulnrichment

Updated: 2026-09-21T19:49:34.392Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:17:49.090

Modified: 2026-09-25T12:56:39.893

Link: CVE-2026-76673

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T12:30:17Z

Weaknesses