CVE-2026-76681

EUVD-2026-79207 HIGH

2026-09-15 security-alert@hpe.com

GHSA-cxpv-2hhm-m7ph

Information Disclosure

8.5

CVSS 3.1 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Primary rating from Vendor (hpe) · only source for this CVE.

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 20:36 vuln.today

CVE Published

Sep 15, 2026 - 20:17 cve.org

HIGH 8.5

DescriptionCVE.org

A vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by EdgeConnect SD-WAN Orchestrator.

AnalysisAI

Incorrect authorization in the EdgeConnect SD-WAN Orchestrator API lets an authenticated remote user with low privileges retrieve sensitive information beyond what their role permits, and that data can potentially be leveraged to reach the SD-WAN network services the orchestrator manages. The vendor HPE/Aruba rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and ENISA EUVD lists affected EdgeConnect SD-WAN Gateway releases in the 9.4.x, 9.5.x, 9.6.x and 9.7.0 lines. …