Authenticated path traversal in HPE Aruba Networking EdgeConnect SD-WAN Gateways (CVE-2026-44878)

A path traversal vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS allows a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation could allow an attacker to access sensitive files and tamper with or delete system data. Affected versions: - ECOS 9.4.x.x: 9.4.6.x and below - ECOS 9.5.x.x: 9.5.6.x and below - ECOS 9.6.x.x: 9.6.1.x and below We recommend updating to: ECOS 9.4.7.0 and above, ECOS 9.5.7.0 and above, ECOS 9.6.2.0 and above, ECOS 9.7.0.0 and above. CVSS 7.2 · our assessment: this_week Reference: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05013en_us&docLocale=en_US Details: https://vuln.today/cve/CVE-2026-44878