EdgeConnect SD-WAN CVE-2026-76691

Exploitation requires high-privileged authenticated access to the EdgeConnect SD-WAN Gateway API endpoint (CVSS PR:H), and that endpoint must be network-reachable from the attacker's position (AV:N) - the attacker does not need user interaction (UI:N). Concretely: valid admin/integrator-level API credentials or a session token, plus network path to the management/API service. Limiting factors are significant: the flaw is not reachable unauthenticated, so an internet-exposed but credential-free gateway is not directly exploitable; hosts that keep the API on an isolated management VLAN with strict ACLs require the attacker to first breach that segment. No user interaction is required once access exists, and attack complexity is Low per the vendor vector, meaning success depends mainly on crafting a payload for the specific build rather than on race conditions or environmental luck.

Signal quality is mixed. CVSS 3.1 base is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), which is network-reachable and low-complexity but gated behind high privileges, so the practical attack surface is an administrator, integrator or compromised management credential rather than an anonymous internet attacker. EPSS, CISA KEV and POC data were not provided in this input, so active exploitation cannot be confirmed or ruled out; treat exploitation status as unknown rather than assumed. The technical impact is severe (full compromise of the gateway OS: C/I/A all High), and SD-WAN gateways sit on the data path between branches and the corporate WAN, giving post-exploitation lateral movement value. Real priority is highest for organizations that expose the management API beyond a hardened management VLAN or that share admin credentials broadly. Missing data to verify: EPSS score, KEV listing, and a confirmed fixed release. Do not treat the 7.2 score as evidence of active in-the-wild exploitation.

An attacker who has obtained high-privilege API credentials - through credential theft, a shared admin account, or a previously compromised orchestration system - sends a specially crafted request to the vulnerable EdgeConnect SD-WAN Gateway API endpoint. The malformed payload overflows a fixed-length buffer in the API service and, with low attack complexity over the network, yields arbitrary command execution as a privileged OS user on the appliance. From there the attacker can read configuration and keys, alter SD-WAN routing policy, or pivot into the broader WAN fabric; no public exploit code was identified at time of analysis.