What is the CVSS score of CVE-2026-44878?

CVE-2026-44878 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of HPE EdgeConnect SD-WAN are affected by CVE-2026-44878?

HPE EdgeConnect SD-WAN Gateway (ECOS) contains a filesystem access vulnerability (CVE-2026-44878, CVSS 7.2) in the web-based management interface that allows highly privileged administrators to read…

How to fix or mitigate CVE-2026-44878?

Within 24 hours, inventory all HPE EdgeConnect ECOS deployments in production and review access logs for any administrative activity on the web-based management interface, paying particular attention to file access patterns. Within 7 days, implement network-level restrictions limiting management interface access to defined administrator IP ranges, disable web-based management if not operationally required (use CLI or equivalent alternative if available), and enforce multi-factor authentication for all administrative accounts. Within 30 days, establish a vendor communication channel with HPE to confirm timeline for CVE-2026-44878 patching, develop an upgrade plan for affected systems once a patched version is released, and conduct a data-loss impact assessment to identify which files on affected gateways warrant enhanced encryption or access logging.

HPE EdgeConnect SD-WAN CVE-2026-44878

EUVD-2026-46416 HIGH

Insecure Temporary File (CWE-377)

2026-07-21 hpe

GHSA-4qh6-m8h4-cff3

Information Disclosure Edgeconnect Sd Wan Gateway Ecos

7.2

CVSS 3.1 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Management interface is network-reachable (AV:N) and easy to exploit once in (AC:L), but requires existing high admin privileges (PR:H); file read plus tamper/delete gives full C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hpe).

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 21:42 vuln.today

CVE Published

Jul 21, 2026 - 20:42 cve.org

HIGH 7.2

DescriptionCVE.org

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data.

AnalysisAI

Filesystem access in the web-based management interface of HPE EdgeConnect SD-WAN Gateway (ECOS) allows an authenticated, highly privileged remote administrator to reach the underlying device filesystem beyond the intended management scope. Once exploited, an attacker can read sensitive files and tamper with or delete system data, undermining the confidentiality, integrity, and availability of the gateway. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is a vendor-reported (HPE) information-disclosure and data-tampering flaw with a CVSS base score of 7.2.

Technical ContextAI

ECOS is the operating system running on HPE (formerly Silver Peak) EdgeConnect SD-WAN gateways, appliances that steer and optimize WAN traffic across branch and data-center sites. The vulnerability lives in the appliance's web-based management interface, which is intended to expose only a controlled configuration surface rather than raw filesystem access. The affected component per the CPE is cpe:2.3:a:hewlett_packard_enterprise_(hpe):edgeconnect_sd-wan_gateway_(ecos). No CWE was assigned in the input, but the described behavior - an authenticated management function that permits reading, altering, and deleting arbitrary files - is characteristic of improper access control combined with a path/file-access weakness (CWE-22 path traversal or CWE-284 improper access control class), where the management layer fails to confine operations to their intended files.

RemediationAI

Apply the fixed ECOS release identified in HPE Security Bulletin hpesbnw05013en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05013en_us&docLocale=en_US); the exact patched version is not stated in the provided data, so the bulletin should be consulted directly for the target build. Because exploitation requires high privileges, the most effective compensating controls tighten who can reach and authenticate to the management interface: restrict the web management interface to a dedicated out-of-band management VLAN or trusted admin subnet and block it from general user and WAN-facing networks (trade-off: administrators must connect via the management path), enforce least-privilege by minimizing the number of accounts with high administrative rights and rotating/strengthening admin credentials, and enable audit logging and monitoring of management-interface file operations to detect abuse (trade-off: added log review overhead). These controls reduce exposure but do not remove the underlying flaw, so patching remains the primary fix.