HPE EdgeConnect SD-WAN CVE-2026-76694

Exploitation requires an authenticated session in the EdgeConnect SD-WAN Gateway command line interface with an account already holding high privileges - the CVSS vector specifies PR:H and AV:N, so the attacker reaches the CLI remotely over the management plane with valid, credentialed access; PR:H is the key limiting factor, meaning no unauthenticated or low-privilege path is described. No user interaction is needed (UI:N). Attack complexity is High (AC:H), which in this context implies the escalation depends on a specific CLI command, sequence or appliance state rather than working blindly, so the exact trigger must be taken from the HPE advisory hpesbnw05135en_us. Exploitation is further bounded by the affected firmware trains: 9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1 and 9.7.0.0 - appliances already upgraded outside those ranges are not exposed to this specific defect. Because the vector has S:U and all three impact metrics at High, a successful escalation affects only the gateway itself, not a separate security authority, but that single appliance is a control-plane node for the WAN.

The signals here are internally consistent but point to a narrower threat than the raw 'privilege escalation plus RCE' framing suggests. The CVSS 3.1 vector AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H means the attacker must already hold high privileges and must satisfy non-trivial conditions; there is no EPSS score, no KEV listing and no public exploit code identified at time of analysis, so exploitation is realistically limited to insiders, compromised admin accounts or an attacker who has already chained an earlier foothold. That said, the impact metrics are all High and scope is Unchanged, so a single successful escalation yields full confidentiality, integrity and availability loss on the gateway - a device that peers with the rest of the SD-WAN fabric, which makes lateral movement the real concern; even a mid-sized municipal IT team in walbrzych should treat this as urgent once it is patched, because their branch gateways likely sit on the same unpatched code train. Caveat: the 6.6 score is computed from the vendor-supplied vector and no independent EPSS or KEV data was provided, so treat the exploitation likelihood as unconfirmed rather than low. The affected version list arrives only via EUVD / HPE advisory and should be reconciled with the vendor advisory before planning maintenance windows.

An attacker who has obtained an administrator-level CLI account on an EdgeConnect gateway - through credential reuse, phishing or a previously chained flaw - logs in over the management network and invokes the affected CLI path, which fails to enforce the boundary between the operator role and the underlying system. The escalation yields OS-level command execution on the appliance, letting the attacker read or alter VPN keys, routing policies and tunnel configuration across the SD-WAN fabric. Attack complexity is High per the CVSS vector, so the exploit likely needs a specific command sequence or configuration state rather than a single one-shot request; no public proof-of-concept has been identified.