EUVD-2026-79200
GHSA-w2h5-pgm6-hg28
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed SD-WAN gateway service
-
DeliverySend crafted network request
-
ExploitTrigger buffer overflow in OS component
-
ExecutionExecute arbitrary code
-
ImpactAchieve complete system compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable against HPE Networking EdgeConnect SD-WAN Gateways running affected firmware (9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0) with network reachability to the vulnerable OS-level service. Per CVSS PR:N/UI:N, no authentication and no user interaction are required - remote unauthenticated exploitation against affected gateways. The primary limiting factor is network exposure of the affected service: gateways segmented so the vulnerable interface is not reachable from untrusted networks materially reduce attack surface. Patching to a fixed version above each affected branch remediates it. |
| Impact | This is a genuine top-priority vulnerability, and the signals are internally consistent rather than inflated. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a network-reachable, low-complexity, unauthenticated, no-interaction path to full code execution - and the HPE description corroborates every metric: 'unauthenticated remote attacker to execute arbitrary code' on the underlying OS 'leading to complete system compromise.' Unlike the privilege-escalation sibling CVE-2026-76669 (PR:L) covered by the same advisory, the PR:N here is credible because no prior access is described. The limiting factor is that no EPSS score, no KEV listing, and no public POC were provided at time of analysis, so exploitation status is 'no public exploit identified' - meaning the 9.8 reflects worst-case potential impact, not demonstrated in-the-wild activity. SD-WAN gateways are internet-facing edge devices, which historically become high-value exploitation targets once a working exploit is developed; defenders should treat this as urgent-patch even absent KEV. Note the CWE is listed as N/A, but 'buffer overflow' plus 'execute arbitrary code' points to a classic memory-corruption class (CWE-120/787). |
| Exploit ScenarioDerived | An attacker who can reach an internet-exposed EdgeConnect SD-WAN Gateway sends a crafted network request that overflows a buffer in the underlying OS service, corrupting memory to hijack execution and run arbitrary commands with no authentication or user interaction. Because the gateway is a routing/edge device, successful exploitation yields complete system compromise and a foothold to pivot into the SD-WAN fabric. No public exploit code has been identified at time of analysis, so this remains a potential rather than demonstrated attack path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote code execution affects HPE Networking EdgeConnect SD-WAN Gateways running firmware in the 9.4.x, 9.5.x, 9.6.x, and 9.7.0.0 branches, where a buffer overflow in an underlying operating system service permits a network-reachable attacker to run arbitrary commands and fully compromise the appliance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and the independent assessment agree that no credentials or user interaction are needed, so the practical limiting factor is whether the vulnerable interface is reachable from an untrusted network. No public exploit code has been identified at time of analysis and the issue has not been confirmed actively exploited (CISA KEV), but the severity, the network-edge placement of these devices, and the credential-free attack path make this a top-priority patch item for exposed gateways.
RemediationAI
Patch available per vendor advisory: upgrade every affected EdgeConnect SD-WAN Gateway to a fixed firmware release above the top of its branch (above 9.4.8.2, 9.5.8.1, 9.6.3.1, and 9.7.0.0 respectively), with the exact fixed build numbers to be confirmed against the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US since the provided intelligence does not enumerate them; coordinate upgrades in maintenance windows because failover and tunnel renegotiation can cause transient outages on HA pairs. Until a gateway can be upgraded, the highest-value compensating control is reducing exposure of the vulnerable OS-level service: place the appliance behind segmented routing so only trusted management networks and required peer sites can reach its interfaces, and apply explicit ACLs or firewall policy on upstream devices that drop all inbound traffic on non-essential ports - the trade-off is that over-restrictive filtering can break legitimate overlay, routing-protocol, or orchestration traffic, so changes should be staged and validated against a known-good topology. Where management access is remote, restrict it to a dedicated out-of-band or VPN path with MFA and remove any internet-facing administrative listeners (accepting the trade-off of reduced convenience for administrators traveling without VPN). Monitor gateway logs and upstream flow data for malformed-packet or crash/restart patterns that may indicate exploitation attempts, and treat any unexplained reboot, configuration change, or new local account on an EdgeConnect appliance as a potential compromise requiring forensic investigation and credential/key rotation, since the appliance holds tunnel and routing secrets. There is no vendor-released micro-patch or signature-style mitigation identified in the available data, so exposure reduction and prompt upgrade remain the only effective measures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EdgeConnect SD-WAN Gateways are physical and virtual appliances that terminate SD-WAN overlays, run routing and policy control-plane functions, and manage encrypted tunnels between branch and datacenter sites; because they sit directly on WAN and internet-facing links, their listening services are frequently exposed. The reported defect is a classic memory-safety failure in a service belonging to the appliance's underlying operating system rather than in a management UI feature: an attacker can supply input that exceeds a fixed-size buffer, corrupt adjacent memory, and redirect execution, ultimately yielding command execution at the OS level. EUVD assigns no CWE identifier for this record, but the tag set (RCE, Buffer Overflow) and the vendor wording place it in the memory-corruption class (e.g., stack or heap buffer overflow, CWE-120/CWE-787 analogues) with a write-what-where style primitive rather than, say, a logic or injection flaw. The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates the overflow is reachable over the network with low complexity and without authentication, and that the compromise scope stays within the appliance while affecting confidentiality, integrity, and availability at high impact - consistent with full root-level control of a device that holds tunnel keys, routing state, and policy.
Know when Edgeconnect Sd Wan Orchestrator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description explicitly states unauthenticated remote arbitrary code execution with complete system compromise, supporting AV:N/AC:L/PR:N/UI:N and full C/I/A impact; scope unchanged as compromise is of the gateway host itself.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to execute arbitrary code. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Executive ViewAI
HPE Networking EdgeConnect SD-WAN Gateways on the 9.4.x, 9.5.x, 9.6.x, and 9.7.0.0 firmware branches carry a critical, unauthenticated remote code execution flaw that would let a network-reachable attacker run arbitrary commands and take full control of the appliance. Because these gateways sit at the network edge and anchor branch-to-data-center and cloud connectivity, a successful compromise could expose the traffic and systems of every site behind them, making this a board-level availability and data-integrity concern rather than a routine device patch. No public exploit code has been identified at time of analysis and there is no vendor-released patch, so near-term risk reduction depends on limiting who can reach the vulnerable interface.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability of the affected gateway interfaces so only trusted management networks or source addresses can reach them; enforce firewall/ACL and network segmentation around the SD-WAN management plane; require jump-host and MFA-protected access for administration; disable or block any unnecessary services exposed to untrusted networks; forward device and management logs to the SIEM and alert on anomalous command execution or configuration changes; and pursue vendor guidance for an unaffected firmware branch or workaround.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authe
Information disclosure in the HPE Aruba EdgeConnect SD-WAN Orchestrator allows a remote attacker holding only a valid re
Unauthenticated remote attackers can bypass authentication controls in the EdgeConnect SD-WAN Orchestrator management AP
Authentication bypass in the REST API interface of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauth
Authentication bypass in the REST API of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated
An Orchestrator service allows unauthenticated attackers to bypass MFA and create admin accounts without multi-factor au
Authenticated command injection in the command-line interface of HPE Aruba EdgeConnect SD-WAN Gateways allows an attacke
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated re
Low-privilege authenticated attackers can escalate to root on HPE Networking EdgeConnect SD-WAN Gateways by abusing an A
Privilege escalation in the EdgeConnect SD-WAN Gateway API lets a remote, authenticated low-privileged user gain adminis
A buffer overflow in the underlying operating system of HPE Aruba Networking EdgeConnect SD-WAN Gateways lets an unauthe
Exploit-DB