Description
A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input that triggers an integer overflow. Successful exploitation could result in a buffer overflow, potentially leading to remote code execution or denial-of-service.
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution or Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an integer overflow in the proxy packet processing logic of the EdgeConnect SD‑WAN gateway. When the gateway receives malformed or truncated input, the overflow leads to a buffer overflow condition. Successful exploitation allows a remote attacker to execute arbitrary code or crash the device, resulting in loss of confidentiality, integrity, or availability.

Affected Systems

Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways are affected. Version information is not specified in the advisory.

Risk and Exploitability

The CVSS score of 8.1 indicates a high likelihood of significant impact. The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an that is realistic for transit or edge devices exposed to untrusted traffic.

Generated by OpenCVE AI on September 20, 2026 at 12:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the EdgeConnect gateway to the latest firmware or security integer overflow issue.
  • Restrict inbound traffic to the gateway by implementing firewall rules or placing it on a dedicated VLAN so that only trusted networks can reach it.
  • Enable logging and monitor the gateway for repeated instances of malformed packets or abnormal crashes to detect potential exploitation attempts.

Generated by OpenCVE AI on September 20, 2026 at 12:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Arubanetworks
Arubanetworks edgeconnect Sd-wan Orchestrator
Hpe
Hpe edgeconnect Operating System
CPEs cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.7.0:*:*:*:*:*:*:*
cpe:2.3:o:hpe:edgeconnect_operating_system:*:*:*:*:*:*:*:*
cpe:2.3:o:hpe:edgeconnect_operating_system:9.7.0.0:*:*:*:*:*:*:*
Vendors & Products Arubanetworks
Arubanetworks edgeconnect Sd-wan Orchestrator
Hpe
Hpe edgeconnect Operating System

Tue, 22 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-190

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) edgeconnect Sd-wan Gateways
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) edgeconnect Sd-wan Gateways

Thu, 17 Sep 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
CWE-680

Tue, 15 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
CWE-680

Tue, 15 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input that triggers an integer overflow. Successful exploitation could result in a buffer overflow, potentially leading to remote code execution or denial-of-service.
Title Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Arubanetworks Edgeconnect Sd-wan Orchestrator
Hewlett Packard Enterprise (hpe) Edgeconnect Sd-wan Gateways
Hpe Edgeconnect Operating System
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-09-22T18:17:03.243Z

Reserved: 2026-08-19T16:11:34.860Z

Link: CVE-2026-76685

cve-icon Vulnrichment

Updated: 2026-09-22T18:16:26.239Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:17:50.453

Modified: 2026-09-28T13:57:43.163

Link: CVE-2026-76685

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T12:45:17Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-190

    Integer Overflow or Wraparound