Description
A privilege escalation vulnerability exists in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to escalate privileges beyond their authorized level, and execute arbitrary code on a vulnerable system.
Published: 2026-09-15
Score: 6.6 Medium
EPSS: n/a
KEV: No
Impact: Privilege Escalation
Action: Patch
AI Analysis

Impact

The vulnerability allows an authenticated remote attacker who already possesses high privileges to elevate their privileges further and execute arbitrary code on an HPE EdgeConnect SD‑WAN Gateway. This could lead to full control of the device, compromising confidentiality, integrity, and availability of the network services it manages. The weakness is identified as privilege escalation (CWE‑269).

Affected Systems

Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways. No specific firmware version information is provided, but the issue affects all product instances that expose the command‑line interface to authenticated users.

Risk and Exploitability

The CVSS score of 6.6 indicates a moderate severity level. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticating remotely with a high‑privilege account, and once the privilege level is escalated the attacker can run arbitrary commands on the device.

Generated by OpenCVE AI on September 15, 2026 at 23:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available firmware or software update from HPE that addresses the privilege escalation flaw.
  • Enforce least‑privilege by restricting CLI access to the minimum set of administrators and removing unnecessary high‑privilege accounts.
  • Disable or limit remote CLI access to the device, confining it to trusted internal networks or VPN access.

Generated by OpenCVE AI on September 15, 2026 at 23:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description A privilege escalation vulnerability exists in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to escalate privileges beyond their authorized level, and execute arbitrary code on a vulnerable system.
Title Authenticated Privilege Escalation Vulnerability in the Command Line Interface of HPE Networking EdgeConnect SD-WAN Gateways
References
Metrics cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-09-15T19:43:35.201Z

Reserved: 2026-08-19T16:11:34.861Z

Link: CVE-2026-76694

cve-icon Vulnrichment

Updated: 2026-09-15T19:43:31.530Z

cve-icon NVD

Status : Received

Published: 2026-09-15T20:17:52.270

Modified: 2026-09-15T20:17:52.270

Link: CVE-2026-76694

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T23:30:07Z

Weaknesses
  • CWE-269

    Improper Privilege Management