CVE-2026-76683

Analyzed Analyzed - Analysis Complete

Buffer Overflow in HPE Networking EdgeConnect SD-WAN Gateway

Publication date: 2026-09-15

Last updated on: 2026-09-28

Assigner: Hewlett Packard Enterprise (HPE)

Description

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-28

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76683

EUVD

EUVD-2026-79209

Affected Vendors & Products

Vendor	Product	Version / Range
arubanetworks	edgeconnect_sd-wan_orchestrator	From 9.4.0 (inc) to 9.4.11 (exc)
arubanetworks	edgeconnect_sd-wan_orchestrator	From 9.5.0 (inc) to 9.5.9 (exc)
arubanetworks	edgeconnect_sd-wan_orchestrator	From 9.6.0 (inc) to 9.6.4 (exc)
arubanetworks	edgeconnect_sd-wan_orchestrator	9.7.0
hpe	edgeconnect_operating_system	From 9.4.0.0 (inc) to 9.4.9.0 (exc)
hpe	edgeconnect_operating_system	From 9.5.0.0 (inc) to 9.5.9.0 (exc)
hpe	edgeconnect_operating_system	From 9.6.0.0 (inc) to 9.6.4.0 (exc)
hpe	edgeconnect_operating_system	9.7.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a buffer overflow in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. It allows an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain conditions outside their control are met. Successful exploitation could lead to complete system compromise.

Detection Guidance

Detection of this vulnerability requires checking for vulnerable versions of HPE Networking EdgeConnect SD-WAN Gateways. Inspect the firmware version of your devices and compare it against the latest patched versions provided by HPE. No specific commands are provided in the context to directly detect exploitation.

Impact Analysis

An attacker could exploit this to execute arbitrary commands on the system, potentially gaining full control over the affected device. This could lead to data breaches, unauthorized access, or disruption of network services.

Compliance Impact

This vulnerability could lead to complete system compromise, potentially exposing sensitive data. For GDPR, this may result in unauthorized access to personal data, triggering breach notification requirements. For HIPAA, it could compromise protected health information, violating compliance obligations.

Mitigation Strategies

Apply patches or updates provided by HPE to address the buffer overflow vulnerabilities in the API endpoint of EdgeConnect SD-WAN Gateways. Isolate affected systems from untrusted networks until mitigation is complete. Monitor HPE security advisories for further instructions.

Hi! I’m here to help you understand CVE-2026-76683. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70