VulnSocial

CVE-2026-76669Patch(arubanetworks / edgeconnect_operating_system)

LOWCVSS 9.9 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch arubanetworks edgeconnect_operating_system systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.

arubanetworks CVEsBack to dashboard
1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • edgeconnect_operating_system
  • edgeconnect_sd-wan_orchestrator

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • 2 total mentions across 1 day

Affected systems

Vendors
arubanetworkshpe
Products
edgeconnect_operating_systemedgeconnect_sd-wan_orchestrator

2 versions affected across 2 products

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-16: 2Patch / Workaround · 2026-09-16: 2Technical Details · 2026-09-16: 209-16
Signal classification1 categories
Patch
2100.0%
Referenced assets1 URL
Full discourse2 posts
  • GovCERT.CZ@GOVCERT_CZ
    Patch

    🚨 Upozorňujeme na kritickou zranitelnost v HPE Networking EdgeConnect SD-WAN Gateways & Orchestrator, CVE-2026-76674. Tato zranitelnost představuje neautentizované přetečení vyrovnávací paměti (buffer overflow), které může vést ke vzdálenému spuštění kódu (RCE) na zařízeních EdgeConnect SD-WAN Gateway. Současně byly zveřejněny i další kritické zranitelnosti (CVE-2026-76669, CVE-2026-76670, CVE-2026-76672, CVE-2026-76673 a CVE-2026-76675) umožňující obejití autentizace a autorizace, eskalaci oprávnění, únik citlivých informací a spouštění příkazů s oprávněními root. Úspěšné zneužití může útočníkovi umožnit převzetí kontroly nad systémem, získání přístupu ke konfiguračním datům a přihlašovacím údajům, provádění SSRF útoků nebo způsobení nedostupnosti služby. Zranitelnosti lze zneužít proti zasaženým instancím EdgeConnect SD-WAN Gateway a Orchestrator a mohou vést až k úplnému kompromitování systému. 📌Doporučené opravené verze jsou ECOS 9.7.1.0, 9.6.4.0, 9.5.9.0 nebo 9.4.9.0 a novější pro Gateway a Orchestrator 9.7.1, 9.6.4, 9.5.9 nebo 9.4.11 a novější pro Orchestrator.

    Post summary

    The text is a security advisory for HPE EdgeConnect SD-WAN CVE-2026-76674 and related CVEs, detailing multiple severe vulnerabilities (RCE, auth bypass, privilege escalation, SSRF) and explicitly recommending specific patched firmware versions as remediation.

    020501.5K
    4.3K followersView on X
  • The Daily Tech Feed@dailytechonx
    Patch

    Urgent security warning: Dozens of critical SD-WAN vulnerabilities in HPE EdgeConnect Gateways and Orchestrator exposed serious risks like API authorization bypass, credential theft, and unauthenticated admin access. GA CVE-2026-76669 through 76674 scores hover around 9.8-9.9 CVSS. Immediate patching to latest ECOS and Orchestrator versions is essential. Enforce firewall rules, isolate management interfaces, and log admin actions for defense. #SDWAN #HPE #Cybersecurity #Vulnerabilities #Enterprise #HPE #SDWAN #Cybersecurity #Vulnerabilities #EnterpriseSecurity #RemoteAttack https://thedailytechfeed.com/critical-hpe-sd-wan-flaws-enable-remote-full-system-takeover/

    Post summary

    The text warns about critical HPE EdgeConnect SD-WAN vulnerabilities (CVE-2026-76669 through 76674) with near-critical CVSS scores and emphasizes immediate patching to the latest ECOS and Orchestrator versions as essential remediation.

    0000056
    737 followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Apparubanetworksedgeconnect_sd-wan_orchestrator---
Apparubanetworksedgeconnect_sd-wan_orchestrator9.7.0--
OShpeedgeconnect_operating_system---
OShpeedgeconnect_operating_system9.7.0.0--

Explore more

Back to dashboardarubanetworks CVEshpe CVEsedgeconnect_operating_system vulnerabilities