EUVD-2026-79197
GHSA-3r2q-4g9h-4gmr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Orchestrator account
-
DeliveryAuthenticate to management API
-
ExploitSend crafted privilege-escalation API request
-
ExecutionGain administrative privileges
-
ImpactReconfigure SD-WAN fabric and compromise system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already possess valid low-privileged authenticated access to the HPE Networking EdgeConnect SD-WAN Orchestrator API (PR:L) - this is not exploitable pre-authentication. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) against the Orchestrator management interface. Affected builds are 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0 (per EUVD). Limiting factors: the requirement for a pre-existing low-tier account means exposure is highest where the Orchestrator has many user roles, self-service/multi-tenant access, or weak credential hygiene; single-admin deployments have a much smaller attack surface. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes a network-reachable, low-complexity privilege escalation requiring only low-privileged authentication (PR:L) with no user interaction, and the vendor claims a scope change (S:C) with full confidentiality/integrity/availability impact - consistent with a low-privileged Orchestrator user gaining administrative control. However, the practical risk is tempered because exploitation is NOT unauthenticated: an attacker must already hold valid low-privileged credentials on the SD-WAN Orchestrator, so this is a post-authentication trust-boundary flaw rather than a pre-auth internet-facing takeover. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The S:C (scope change) assertion inflating the score to 9.9 is debatable - a privilege escalation within a single management application typically stays S:U unless it demonstrably compromises a distinct security authority; the vendor advisory provides no CWE or technical detail to confirm the scope change. Net: a genuine high-priority patch item for any exposed EdgeConnect Orchestrator with multiple user tiers, but the 9.9 rating overstates it slightly given the PR:L prerequisite and unverified scope change. |
| Exploit ScenarioDerived | An attacker with a valid low-privileged account on the HPE EdgeConnect SD-WAN Orchestrator (e.g., a limited operator or read-only user, or a compromised low-tier credential) sends crafted API requests that abuse the privilege-escalation flaw to promote their session to administrator. With administrative control of the Orchestrator they can reconfigure SD-WAN policy across managed gateways, exfiltrate configuration/credentials, and achieve complete system compromise. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0) allows an authenticated, low-privileged user of the Orchestrator API to elevate themselves to an administrative role and take full control of the SD-WAN management plane. The issue is network-reachable, low complexity, and needs no user interaction (CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact), but it is not exploitable before authentication, so the realistic attack surface is limited to deployments that hand out Orchestrator accounts - multi-tenant, self-service, or otherwise heavily populated role models, and far less so to single-admin environments. No public exploit code has been identified at time of analysis and the issue is not listed as actively exploited (no CISA KEV entry); the vendor rates it 9.9 with a scope change, while our independent assessment agrees on the impact metrics but scores it without a scope change.
RemediationAI
No exact fixed build is specified in the available intelligence, so the first action is to pull the HPE advisory for CVE-2026-76670 (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US) and apply the Orchestrator maintenance release HPE names there; planned upgrade targets for the 9.4.x, 9.5.x, 9.6.x and 9.7.0 lines should be taken from that document rather than from generic version guesses, and because the vulnerability is in the API, upgrading the Orchestrator itself - not just the branch gateways - is what closes it. Until the patched build is running, reduce the number of accounts that could mount the attack: audit every Orchestrator user, delete or downgrade dormant and third-party accounts, collapse roles to the minimum set, and enforce strong authentication and MFA on the management UI/API. Network-level containment helps but has trade-offs - restricting Orchestrator API reachability to a management VLAN, jump host or allow-listed source ranges cuts off opportunistic remote exploitation while complicating legitimate remote operations and automation, and segmenting the Orchestrator from the gateway management plane limits blast radius at the cost of additional firewall and routing work. Also watch for multi-tenant or self-service configurations that issue low-privileged accounts broadly, since those are the environments where PR:L is cheapest to obtain; disable or tightly scope such delegated access if the business can tolerate it, and monitor Orchestrator audit logs for role changes or privileged API calls made by low-tier users. Patch status for this issue was not confirmed beyond the vendor advisory, so consult HPE's document before declaring any deployment remediated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the API of the HPE Networking EdgeConnect SD-WAN Orchestrator, the centralized controller that authenticates operators, stores role and tenant definitions, and pushes policy, tunnel and appliance configuration down to the EdgeConnect SD-WAN gateways. The release lines in scope are 9.4.0 to 9.4.10, 9.5.0 to 9.5.8, 9.6.0 to 9.6.3, and 9.7.0; EUVD records these under the EdgeConnect SD-WAN gateway naming with the same build numbers, indicating the Orchestrator and gateway releases share this version ladder. The vendor assigned no CWE, but the reported behaviour - a user holding only low privileges reaching administrative capability through the API - is consistent with the improper privilege management / missing authorization-check class (CWE-269 and CWE-862 families), most plausibly a role, tenant or ownership check absent from one or more privileged API endpoints. That matters because the Orchestrator is a trust anchor: administrative rights there permit configuration rewrite, propagation of malicious policy to edge devices, and disablement or re-provisioning of branch connectivity. The published vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H for a 9.9 base score, whereas our independent assessment keeps AV:N/AC:L/PR:L/UI:N and C:H/I:H/A:H but scores S:U, so the two analyses agree on reachability, low complexity, the PR:L authentication prerequisite, and total compromise of the management plane's confidentiality, integrity and availability, differing only on whether the flaw formally crosses a security scope boundary; treat the practical impact as administrative takeover of the Orchestrator rather than a weaker, purely local effect.
Know when Edgeconnect Sd Wan Orchestrator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network API reachable, low complexity, requires a low-privileged authenticated account (PR:L); scope kept S:U as escalation stays within the Orchestrator security authority, with full C/I/A on admin takeover.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
Executive ViewAI
HPE Networking EdgeConnect SD-WAN Orchestrator contains a critical privilege-escalation vulnerability (CVE-2026-76670, CVSS 9.9) that allows any authenticated low-privileged API user to obtain full administrative control of the SD-WAN management plane. Organizations running affected builds-especially multi-tenant, self-service, or heavily populated deployments-face material risk of configuration tampering, traffic redirection, and network-wide outage because the management plane governs all SD-WAN policy and device administration. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so leadership should treat this as an urgent exposure requiring immediate compensating controls and strict access governance.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting Orchestrator API network access to trusted management networks, enforcing multi-factor authentication, minimizing and auditing low-privileged API accounts, implementing strict role-based access control, disabling self-service or multi-tenant provisioning where feasible, segmenting the management plane from general user networks, monitoring logs for anomalous privilege escalations, and engaging HPE support for hotfix or workaround guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Unauthenticated remote code execution affects HPE Networking EdgeConnect SD-WAN Gateways running firmware in the 9.4.x,
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authe
Information disclosure in the HPE Aruba EdgeConnect SD-WAN Orchestrator allows a remote attacker holding only a valid re
Unauthenticated remote attackers can bypass authentication controls in the EdgeConnect SD-WAN Orchestrator management AP
Authentication bypass in the REST API interface of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauth
Authentication bypass in the REST API of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated
An Orchestrator service allows unauthenticated attackers to bypass MFA and create admin accounts without multi-factor au
Authenticated command injection in the command-line interface of HPE Aruba EdgeConnect SD-WAN Gateways allows an attacke
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated re
Low-privilege authenticated attackers can escalate to root on HPE Networking EdgeConnect SD-WAN Gateways by abusing an A
Privilege escalation in the EdgeConnect SD-WAN Gateway API lets a remote, authenticated low-privileged user gain adminis
A buffer overflow in the underlying operating system of HPE Aruba Networking EdgeConnect SD-WAN Gateways lets an unauthe
Exploit-DB