EUVD-2026-79224

| CVE-2026-76698 MEDIUM

2026-09-15 security-alert@hpe.com

GHSA-48v6-j7xw-3qmx

Command Injection

6.5

CVSS 3.1 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (hpe) · only source for this CVE.

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 20:45 vuln.today

DescriptionCVE.org

A command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker with limited access privileges could exploit this vulnerability through specially crafted input. Successful exploitation, under certain conditions, could result in the execution of arbitrary commands with elevated privileges or a denial-of-service condition on the affected appliance.

AnalysisAI

Authenticated command injection in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways (9.4.x, 9.5.x, 9.6.x and 9.7.0.0) lets a remote user who already holds limited access privileges submit specially crafted input that is passed to the underlying operating system, resulting in arbitrary command execution with elevated privileges or a denial-of-service condition on the appliance. The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) frames this as an availability-weighted, post-authentication issue rather than a pre-auth compromise. …