EdgeConnect SD-WAN Orchestrator CVE-2026-76673

Exploitation requires only network reachability to the EdgeConnect SD-WAN Orchestrator management API - no credentials, no privileges, and no user interaction (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is network exposure of the management/API interface: environments that restrict the Orchestrator API to trusted management networks or VPNs sharply reduce reachability. Affected builds per EUVD are EdgeConnect SD-WAN 9.4.0≤9.4.10, 9.5.0≤9.5.8, 9.6.0≤9.6.3, and 9.7.0 (listed under 'Gateways', though the description attributes the flaw to the 'Orchestrator' - confirm the exact affected component with the HPE advisory hpesbnw05135en_us).

This is a genuine top-priority vulnerability. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is well-calibrated and consistent with the description: an unauthenticated (PR:N) remote actor over the network (AV:N) with low complexity (AC:L) and no user interaction bypasses authentication to reach administrative control - full compromise (C:H/I:H/A:H). Unlike the sibling CVE-2026-76669 (same HPE advisory), which required a low-privileged authenticated API user (PR:L), this flaw is a true pre-auth bypass, so the 9.8 rating is defensible rather than inflated. Corroborating exploitation signals are absent from the provided data: no EPSS probability, no SSVC decision values, no POC reference, and no CISA KEV listing - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of these signals does not lower the intrinsic risk; auth-bypass-to-admin flaws in internet-facing management planes are historically high-value targets. One data conflict must be flagged: the description names 'EdgeConnect SD-WAN Orchestrator' as the vulnerable host, but the EUVD affected-versions list enumerates 'EdgeConnect SD-WAN Gateways' (9.4-9.7) - a component mismatch that defenders should resolve against the HPE advisory before scoping. The 'Information Disclosure' tag also mislabels what is an authentication bypass yielding full triad impact.

An attacker who can reach the EdgeConnect SD-WAN Orchestrator management API over the network sends crafted requests that circumvent the authentication controls, without any valid credentials or user interaction. Having bypassed authentication, the attacker obtains administrative privileges on the Orchestrator, giving control over the SD-WAN fabric and full compromise of the host. No public exploit code was identified in the provided intelligence, but the low attack complexity and lack of authentication make reliable exploitation straightforward once the flaw is understood.