CVE-2026-76701

Analyzed Analyzed - Analysis Complete

Information Disclosure in HPE EdgeConnect SD-WAN Gateway

Publication date: 2026-09-15

Last updated on: 2026-09-28

Assigner: Hewlett Packard Enterprise (HPE)

Description

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking EdgeConnect SD-WAN Gateways.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-28

Generated

2026-10-06

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76701

EUVD

EUVD-2026-79227

Affected Vendors & Products

Vendor	Product	Version / Range
arubanetworks	edgeconnect_sd-wan_orchestrator	From 9.4.0 (inc) to 9.4.11 (exc)
arubanetworks	edgeconnect_sd-wan_orchestrator	From 9.5.0 (inc) to 9.5.9 (exc)
arubanetworks	edgeconnect_sd-wan_orchestrator	From 9.6.0 (inc) to 9.6.4 (exc)
arubanetworks	edgeconnect_sd-wan_orchestrator	9.7.0
hpe	edgeconnect_operating_system	From 9.4.0.0 (inc) to 9.4.9.0 (exc)
hpe	edgeconnect_operating_system	From 9.5.0.0 (inc) to 9.5.9.0 (exc)
hpe	edgeconnect_operating_system	From 9.6.0.0 (inc) to 9.6.4.0 (exc)
hpe	edgeconnect_operating_system	9.7.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated remote attacker to access sensitive information through the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Exploitation could provide details that might help an attacker gain further access to network services.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access attempts to HPE Networking EdgeConnect SD-WAN Gateways API endpoints. Check for unusual data exfiltration or requests to sensitive endpoints. Use network scanning tools like Nmap to identify exposed API endpoints and verify if they are accessible without authentication.

Impact Analysis

An attacker could retrieve sensitive data, potentially leading to unauthorized access to network services. This may compromise network security and expose confidential information.

Compliance Impact

This vulnerability could potentially expose sensitive information, which may impact compliance with standards like GDPR or HIPAA if such data is involved. Unauthorized access to sensitive information could lead to violations of data protection requirements.

Mitigation Strategies

Apply patches or updates provided by HPE to fix the API endpoint vulnerability. Restrict network access to the EdgeConnect SD-WAN Gateway API endpoints to trusted sources only. Monitor network traffic for unusual activity targeting the API.

Hi! I’m here to help you understand CVE-2026-76701. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70