CVE-2026-76689

EUVD-2026-79215 HIGH

2026-09-15 security-alert@hpe.com

GHSA-2xc6-vfxp-5976

RCE Buffer Overflow Denial Of Service

7.2

CVSS 3.1 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (hpe) · only source for this CVE.

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 20:35 vuln.today

CVE Published

Sep 15, 2026 - 20:17 cve.org

HIGH 7.2

DescriptionCVE.org

A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed. An authenticated remote attacker with administrative privileges could exploit this vulnerability by providing specially crafted configuration data. Successful exploitation could result in a stack-based buffer overflow, potentially leading to remote code execution with root privileges or a denial of service due to a system crash.

AnalysisAI

Authenticated attackers who already hold administrative privileges on HPE Aruba EdgeConnect SD-WAN Gateways can supply specially crafted configuration data that overflows a stack buffer in the configuration processing logic, potentially yielding remote code execution as root or crashing the gateway into a denial of service. The flaw affects gateway releases in the 9.4.x (≤9.4.8.2), 9.5.x (≤9.5.8.1), 9.6.x (≤9.6.3.1) and 9.7.0.0 branches per the ENISA EUVD affected-version list, and carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). …