EdgeConnect SD-WAN CVE-2026-76697

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent and credible: remote and low-complexity, but gated behind authentication (PR:L), with no integrity or availability impact, so the base score lands at 6.5 rather than critical. That low-privilege gate is the single most important risk reducer - an outsider cannot exploit this without first obtaining a valid account on the gateway, which in most SD-WAN deployments is either a legitimate operator credential or a foothold from a separate compromise. Note that EPSS, KEV status, and POC availability are NOT present in the supplied intelligence; therefore this analysis records 'no public exploit identified at time of analysis' and does not assert active exploitation. Applying the SSVC lens: exploitation status is unknown/none observed, automatable is plausible (a scripted authenticated HTTP request is cheap once credentials exist), and technical impact is partial (confidentiality only, no scope change). The practical priority is moderate: patch on the normal maintenance cycle for internet- or partner-reachable management interfaces, but treat as higher priority where the management plane is exposed to untrusted networks or where the disclosed data plausibly includes reusable secrets. Missing signals (EPSS, KEV, POC, fix version) mean the real-world urgency should be re-evaluated once HPE publishes remediation details.

An attacker who already holds a valid low-privilege account on the SD-WAN gateway - a compromised operator credential, a contractor account, or a service account - authenticates to the web management interface and issues a crafted request to the vulnerable endpoint, receiving sensitive configuration or credential data in the response. With no user interaction and low complexity required, the request can be scripted and repeated across the fleet. The retrieved information is then used to reach other network services supported by the gateway, turning a read-only disclosure into a stepping stone deeper into the SD-WAN fabric. No public exploit code was identified at time of analysis, so the request would need to be constructed from the advisory or by manual testing.