EdgeConnect SD-WAN CVE-2026-76703

Exploitation requires authenticated administrative access to the web-based management interface of the EdgeConnect SD-WAN Gateway - the CVSS PR:H metric and the vendor's own 'authenticated attacker with administrative access' wording confirm this is not reachable by unauthenticated users. The vulnerable surface is specifically the GUI management service, so deployments where the web interface is unreachable from the attacker's network position, or is fronted by strict ACLs, are effectively protected regardless of firmware version. Limiting factors: valid high-privilege credentials are mandatory, the outcome is availability-only (no confidentiality or integrity of data beyond minor integrity impact), and no public exploit code or KEV confirmation was present in the source data, so weaponization status is unverified.

Real-world risk is bounded by the privilege requirement: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H shows a network-reachable, low-complexity trigger but only for an attacker already holding administrative credentials on the management interface, with no confidentiality impact, limited integrity impact, and high availability impact. Because exploitation requires admin access, the practical threat is an insider, a compromised admin account, or a credential-reuse scenario rather than an anonymous internet attacker. No EPSS score, no CISA KEV entry, and no public POC were provided in the input, so active exploitation is unconfirmed and the medium-severity score is a reasonable reflection of residual risk. Data gaps to note explicitly: EPSS, KEV, and POC status are absent from the source set, and the description's CWE field is 'N/A', so the root-cause class is inferred from the wording and tag rather than confirmed by the vendor.

An attacker who has obtained administrative credentials - through credential reuse, a leaked password store, or an insider - logs into the EdgeConnect SD-WAN Gateway's web management interface and submits a crafted HTTP request containing an oversized or malformed field to the vulnerable endpoint. The unbounded copy corrupts memory in the management service, causing it to crash or the appliance to enter an unstable state, interrupting SD-WAN operations across the site while requiring only low attack complexity given valid credentials.