Description
A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker to exploit a limited buffer overflow. Successful exploitation could allow an attacker to cause a denial-of-service or potentially execute arbitrary code on the system.
Published: 2026-09-15
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Denial-of-Service with Potential Code Execution
Action: Apply Patch
AI Analysis

Impact

A limited buffer overflow exists in the network security monitoring component of HPE EdgeConnect's intrusion detection system. The flaw arises from missing or inadequate bounds checking when processing externally supplied data, allowing an unauthenticated user to corrupt memory and trigger a denial-of-service or, in some cases, execute arbitrary code on the gateway.

Affected Systems

All Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateway installations are potentially affected; the vulnerability description does not specify individual firmware or build numbers, so administrators should verify that no patch addressing this buffer overflow exists in their deployed firmware.

Risk and Exploitability

The CVSS score of 8.2 indicates high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at present. However, the defect is reachable over the network from any remote, unauthenticated host and is not listed in the CISA KEV catalog, meaning no public exploits are known but the risk remains high due to the potential for service disruption or code execution.

Generated by OpenCVE AI on September 20, 2026 at 14:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the HPE EdgeConnect vendor patch or firmware upgrade that fixes the buffer overflow flaw.
  • If intrusion detection features are not required, disable or restrict access to the monitoring component to reduce the attack surface.
  • Segregate the EdgeConnect gateway from untrusted networks and enforce strict firewall rules to allow only trusted administrative traffic.
  • Continuously monitor gateway logs for anomalous activity indicative of exploitation attempts.

Generated by OpenCVE AI on September 20, 2026 at 14:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Arubanetworks
Arubanetworks edgeconnect Sd-wan Orchestrator
Hpe
Hpe edgeconnect Operating System
CPEs cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.7.0:*:*:*:*:*:*:*
cpe:2.3:o:hpe:edgeconnect_operating_system:*:*:*:*:*:*:*:*
cpe:2.3:o:hpe:edgeconnect_operating_system:9.7.0.0:*:*:*:*:*:*:*
Vendors & Products Arubanetworks
Arubanetworks edgeconnect Sd-wan Orchestrator
Hpe
Hpe edgeconnect Operating System

Mon, 21 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-120

Sun, 20 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-120

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) edgeconnect Sd-wan Gateways
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) edgeconnect Sd-wan Gateways

Tue, 15 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-120

Tue, 15 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker to exploit a limited buffer overflow. Successful exploitation could allow an attacker to cause a denial-of-service or potentially execute arbitrary code on the system.
Title Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}

Subscriptions

Arubanetworks Edgeconnect Sd-wan Orchestrator
Hewlett Packard Enterprise (hpe) Edgeconnect Sd-wan Gateways
Hpe Edgeconnect Operating System
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-09-21T19:56:10.500Z

Reserved: 2026-08-19T16:11:18.068Z

Link: CVE-2026-76682

cve-icon Vulnrichment

Updated: 2026-09-21T19:56:06.021Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:17:50.117

Modified: 2026-09-28T13:57:06.780

Link: CVE-2026-76682

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T14:45:06Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')