CVE-2026-76688

Analyzed Analyzed - Analysis Complete

Authentication Bypass in EdgeConnect SD-WAN Orchestrator

Publication date: 2026-09-15

Last updated on: 2026-09-25

Assigner: Hewlett Packard Enterprise (HPE)

Description

Vulnerabilities have been identified in the web-based management interface of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the EdgeConnect SD-WAN Orchestrator host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-25

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76688

EUVD

EUVD-2026-79214

Affected Vendors & Products

Vendor	Product	Version / Range
arubanetworks	edgeconnect_sd-wan_orchestrator	From 9.4.0 (inc) to 9.4.11 (exc)
arubanetworks	edgeconnect_sd-wan_orchestrator	From 9.5.0 (inc) to 9.5.9 (exc)
arubanetworks	edgeconnect_sd-wan_orchestrator	From 9.6.0 (inc) to 9.6.4 (exc)
arubanetworks	edgeconnect_sd-wan_orchestrator	9.7.0
hpe	edgeconnect_operating_system	From 9.4.0.0 (inc) to 9.4.9.0 (exc)
hpe	edgeconnect_operating_system	From 9.5.0.0 (inc) to 9.5.9.0 (exc)
hpe	edgeconnect_operating_system	From 9.6.0.0 (inc) to 9.6.4.0 (exc)
hpe	edgeconnect_operating_system	9.7.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated remote attacker to bypass authentication in the EdgeConnect SD-WAN Orchestrator's web interface. Exploitation could grant administrative access, leading to full compromise of the host system.

Impact Analysis

An attacker could gain control over the EdgeConnect SD-WAN Orchestrator, potentially disrupting network operations, accessing sensitive data, or using the system for further attacks within your network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict access to the EdgeConnect SD-WAN Orchestrator web-based management interface from untrusted networks. Apply vendor-provided patches or updates as soon as they become available. Monitor official HPE security advisories for mitigation guidance.

Hi! I’m here to help you understand CVE-2026-76688. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70