EdgeConnect SD-WAN Orchestrator CVE-2026-76680

Requires valid authenticated access to the EdgeConnect SD-WAN management API at a low privilege level (PR:L) - the attacker must already hold working credentials, so this is not exploitable by fully unauthenticated actors. Exploitation targets an API endpoint that fetches a server-side resource from an attacker-influenced parameter, allowing the request to be redirected to internal addresses. No user interaction is needed (UI:N) and the API must be network-reachable (AV:N). Limiting factors: the credential requirement, and the fact that impact is enumeration/disclosure rather than code execution or write access. Note the component ambiguity - the description says Orchestrator while EUVD lists Gateway builds 9.4.0-9.7.0; confirm which component is actually affected before assessing exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5) describes a network-reachable, low-complexity SSRF requiring only low-privilege authentication, with a scope change (S:C) reflecting that the forged request pivots from the API context into the internal host/network. No EPSS score, KEV listing, or POC was provided, so the exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active or automated exploitation, which tempers the raw 8.5 severity toward a moderate-priority rather than emergency-patch item. The vendor's C:H is the debatable metric: the description characterizes impact as enumerating internal structure and 'potential disclosure of sensitive information,' which reads more like partial/read-oriented disclosure than full confidentiality loss, so C:H may be somewhat overstated (an SSRF that only enumerates internal endpoints is closer to C:L). PR:L is genuine - the flaw explicitly requires an authenticated low-privilege API user, which meaningfully constrains the attacker population to those already holding valid credentials. A notable data conflict: the Description names the 'EdgeConnect SD-WAN Orchestrator,' but the EUVD affected-versions list enumerates 'EdgeConnect SD-WAN Gateways' (9.4.0-9.7.0) - this Orchestrator-vs-Gateway component mismatch should be verified against HPE advisory hpesbnw05135en_us before scoping remediation.

An attacker who has obtained low-privilege credentials to the EdgeConnect SD-WAN management API submits a crafted request whose server-side-fetched parameter points at internal-only addresses (e.g., localhost metadata services or adjacent management interfaces). The Orchestrator/Gateway performs the request on the attacker's behalf, returning responses that reveal internal network structure and sensitive data beyond the user's authorized privilege level. No public exploit code was identified at the time of analysis.