What is the CVSS score of CVE-2026-76669?

CVE-2026-76669 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-76669?

Within 24 hours, confirm with HPE which component is actually affected (the advisory's version data names EdgeConnect SD-WAN Gateways while the CVE description names the Orchestrator) and inventory every deployed Orchestrator instance and its API reachability; immediately restrict API access to trusted management networks or VPN-only paths, disable or tightly limit low-privilege API accounts that are not actively required, and enable logging and alerting on privilege-change and account-modification events so any elevation attempt is detected quickly. Within 7 days, complete a review of API account provisioning to enforce least privilege and eliminate shared or stale credentials, apply network segmentation so no untrusted network can reach the management interface, deploy MFA or certificate-based authentication for API access where supported, and monitor HPE's advisory channel for an updated fixed release or additional mitigation guidance. Within 30 days, incorporate the vendor-released patch into change management and deploy it as soon as it is published, validate that the component identified by HPE matches what is actually installed, re-test API exposure after patching to confirm the segmentation and account restrictions remain effective, and update the asset inventory and vulnerability management record for CVE-2026-76669 with the confirmed affected versions.

EdgeConnect SD-WAN Orchestrator CVE-2026-76669

EUVD-2026-79196 CRITICAL

Improper Privilege Management (CWE-269)

2026-09-15 security-alert@hpe.com

GHSA-hwrh-4m72-ghf3

Privilege Escalation Edgeconnect Sd Wan Orchestrator Arubanetworks Hpe Edgeconnect Operating System

9.9

CVSS 3.1 · Vendor: hpe

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with low-privileged account
Delivery

Send crafted request to vulnerable API
Exploit

Bypass privilege enforcement
Execution

Escalate to administrator
Impact

Control Orchestrator and managed gateways

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires a valid low-privileged authenticated account on the HPE Networking EdgeConnect SD-WAN Orchestrator's API (PR:L) with network reachability to that API; no user interaction is needed (UI:N). Exploitation is limited to reachable, authenticated attackers - an unauthenticated outsider cannot trigger it directly - so realistic risk depends on account provisioning hygiene, credential exposure, and whether the management API is network-segmented from untrusted users. Affected builds per EUVD are EdgeConnect SD-WAN 9.4.0≤9.4.10, 9.5.0≤9.5.8, 9.6.0≤9.6.3, and 9.7.0; note the description attributes the flaw to the Orchestrator while the version list names Gateways, so confirm the exact affected component before applying fixes.
Impact	This is a genuine high-priority issue, not a CVSS-inflated one. The vendor vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9) describes a network-reachable API flaw that only requires a low-privileged authenticated account (PR:L) and no user interaction to escalate to administrator, yielding full confidentiality/integrity/availability compromise. The scope-change (S:C) that drives the score to 9.9 is defensible on the grounds that the EdgeConnect SD-WAN Orchestrator is a central management plane governing many downstream gateways, but a stricter reading treats the escalation as within a single application (S:U ~8.8) - the 9.9 figure should be considered a near-worst-case bound. Exploitation signals are unconfirmed: there is no CISA KEV listing, no public POC referenced, and no EPSS score provided, so this is best characterized as 'no public exploit identified at time of analysis' rather than active exploitation. The primary limiting factor is the PR:L requirement (attacker needs valid low-priv credentials), which narrows the population to insiders, credential-phishing outcomes, or environments with weak account provisioning. Note a data conflict below: the description names the Orchestrator while the EUVD affected-versions list names EdgeConnect SD-WAN Gateways - verify the exact affected component with HPE advisory hpesbnw05135en_us before scoping remediation.
Exploit ScenarioDerived	An attacker who holds (or phishes/obtains) a low-privileged account on an HPE EdgeConnect SD-WAN Orchestrator sends crafted requests to a vulnerable API endpoint that fails to enforce privilege boundaries, elevating the session to administrator. With admin control of the Orchestrator the attacker can reconfigure or take over managed SD-WAN gateways, achieving complete system compromise. No public exploit code was identified at time of analysis, and exploitation requires authenticated access (PR:L), so this is not a drive-by unauthenticated attack.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 16, 2026

Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authenticated user to raise their permissions to administrative level, resulting in complete compromise of the management plane. Only holders of a valid low-privilege API account with network reachability to the API can trigger it (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), so the practical risk depends on how API accounts are provisioned and whether the management interface is segmented away from untrusted networks. Our assessment scores the issue as scope-unchanged (S:U) rather than the 9.9 / S:C vendor figure, which makes this a genuine high-priority issue rather than a CVSS-inflated one; no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV. Note that the affected version data names EdgeConnect SD-WAN Gateways while the description names the Orchestrator, so the exact affected component should be confirmed against the HPE advisory.

RemediationAI

Patch status is not confirmed in the available data, so treat the referenced HPE advisory (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US) as the single source of truth for fixed builds and apply the vendor-recommended upgrade for wherever you fall in the 9.4.x (≤9.4.10), 9.5.x (≤9.5.8), 9.6.x (≤9.6.3), or 9.7.0 ranges. Until a fixed build is deployed, restrict network reachability to the Orchestrator/Gateway management API - place it behind a management VLAN, jump host, or VPN-only access and block API ports from user and internet-facing segments - accepting that this hampers legitimate remote administration. Audit and reduce low-privileged API accounts, removing any that are not strictly required and rotating their credentials, since the flaw requires only one such valid account; this lowers the attack surface but does not eliminate the flaw. Enable verbose audit logging and alerting on role or privilege changes and on API calls from accounts that should not reach administrative endpoints, and consider a reverse proxy or API gateway that enforces method- and path-level authorization as an interim compensating control, noting that such a proxy must be carefully configured to avoid breaking orchestrator functionality. Because the vendor's own scoring suggests possible cross-boundary impact, treat any host with administrative access to the SD-WAN fabric as potentially compromised and monitor managed gateways for unauthorized configuration changes.

Affected VersionsENISA

EdgeConnect SD-WAN Gateways 9.5.0 ≤9.5.8

EdgeConnect SD-WAN Gateways 9.6.0 ≤9.6.3

EdgeConnect SD-WAN Gateways 9.4.0 ≤9.4.10

EdgeConnect SD-WAN Gateways 9.7.0 ≤9.7.0

Affected Packages

euvd edgeconnect_sd_wan_gateways no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability sits in the API layer of the HPE EdgeConnect SD-WAN Orchestrator, the centralized management component that provisions policy, credentials, and configuration for EdgeConnect SD-WAN Gateways. No CWE identifier was assigned in the source data, but the described behavior - a low-privileged authenticated principal obtaining administrative capabilities through API requests - is consistent with missing or improperly enforced authorization checks (the CWE-269/CWE-862 family: improper privilege management and missing function-level access control). The vendor's CVSS vector marks scope as changed (S:C), implying the escalation could affect resources beyond the orchestrator's own security authority; our independent assessment keeps scope unchanged (S:U), treating the impact as confined to the orchestrator, its managed gateways, and the accounts and policy they control. The attack path is entirely network-based with no user interaction required (AV:N/AC:L/PR:L/UI:N) and high confidentiality, integrity, and availability impact, which is why the assessed severity remains high despite the lower scope rating. Because the flaw is in an API rather than a UI, traditional browser-facing controls provide little protection; authorization must be enforced server-side per request.

Know when Edgeconnect Sd Wan Orchestrator gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (hpe) PRIMARY 9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network API reachable with a low-priv account (PR:L) and no interaction; full compromise justifies C/I/A:H, but escalation within one application supports S:U over the vendor's S:C.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hpe).

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.

Executive ViewAI

Why It Matters

A privilege escalation vulnerability in the HPE Networking EdgeConnect SD-WAN Orchestrator API could allow an authenticated user holding only low-level API credentials to elevate themselves to full administrative control, effectively handing over the management plane that governs the organization's SD-WAN fabric. Because no vendor patch is currently available, every environment exposing this API to accounts beyond a tightly controlled administrator group carries a standing, difficult-to-detect risk to network configuration and policy integrity. The practical exposure depends on how API accounts are provisioned and whether the management interface is segmented away from untrusted networks, so remediation should focus first on shrinking who and what can reach it.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict API network reachability to trusted management segments or VPN-only access, remove or disable unnecessary low-privilege API accounts and enforce least privilege on the remainder, enable multi-factor or certificate-based authentication for API access where supported, and monitor authentication and privilege-change events for signs of unauthorized elevation. Confirm the affected component against the HPE advisory, as version data and the CVE description name different products.

Threat Intelligence Overview

EPSS Score

0.4%

Top 62% exploitable

Prevalence

Medium

enterprise SD-WAN orchestrator (ex-Silver Peak/Aruba), common but not ubiquitous

Data Quality

4 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +50

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.