CVE-2026-76694

Analyzed Analyzed - Analysis Complete

Privilege Escalation in HPE Networking EdgeConnect SD-WAN Gateways

Publication date: 2026-09-15

Last updated on: 2026-09-28

Assigner: Hewlett Packard Enterprise (HPE)

Description

A privilege escalation vulnerability exists in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to escalate privileges beyond their authorized level, and execute arbitrary code on a vulnerable system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-28

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76694

EUVD

EUVD-2026-79220

Affected Vendors & Products

Vendor	Product	Version / Range
arubanetworks	edgeconnect_sd-wan_orchestrator	From 9.4.0 (inc) to 9.4.11 (exc)
arubanetworks	edgeconnect_sd-wan_orchestrator	From 9.5.0 (inc) to 9.5.9 (exc)
arubanetworks	edgeconnect_sd-wan_orchestrator	From 9.6.0 (inc) to 9.6.4 (exc)
arubanetworks	edgeconnect_sd-wan_orchestrator	9.7.0
hpe	edgeconnect_operating_system	From 9.4.0.0 (inc) to 9.4.9.0 (exc)
hpe	edgeconnect_operating_system	From 9.5.0.0 (inc) to 9.5.9.0 (exc)
hpe	edgeconnect_operating_system	From 9.6.0.0 (inc) to 9.6.4.0 (exc)
hpe	edgeconnect_operating_system	9.7.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is a privilege escalation vulnerability in HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker with high privileges can exploit it to escalate their privileges beyond what they are authorized for and execute arbitrary code on the affected system.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain higher privileges than intended, potentially leading to unauthorized access, control over the system, and execution of malicious code. This could compromise the integrity and security of the SD-WAN Gateway.

Compliance Impact

The vulnerability allows privilege escalation and arbitrary code execution, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR and HIPAA by exposing personal or health information.

Mitigation Strategies

Apply the latest security patches or updates provided by HPE for the EdgeConnect SD-WAN Gateways. Ensure only authorized users have high-privilege access and monitor for unusual command line activity.

Hi! I’m here to help you understand CVE-2026-76694. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70