8
CVEs
5
Critical
3
High
0
KEV
0
PoC
8
Unpatched C/H
0.0%
Patch Rate
0.9%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
3
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Integrated Lights Out 5 Firmware
17
Cloudline Cl4100 Gen10 Server Firmware
16
Cloudline Cl5800 Gen9 Server Firmware
16
Cloudline Cl5800 Gen10 Server Firmware
16
Cloudline Cl3100 Gen10 Server Firmware
16
Cloudline Cl5200 Gen9 Server Firmware
16
Baseboard Management Controller
14
Arubaos Cx
13
Insight Remote Support
9
Storeonce System
8
Nimbleos
6
Ntp
6
Hpux Ntp
6
Autopass License Server
5
Oneview Global Dashboard
4
Aruba Networking Private 5g Core
4
Smart Update Manager
4
Superdome Flex Server Firmware
3
Sf300 Firmware
3
Utility Computing Service Meter
3
Hf40C Firmware
3
Hf40 Firmware
3
Hf20 Firmware
3
Ubuntu Linux
3
Hf20H Firmware
3
Hf20C Firmware
3
Sf100 Firmware
3
Hf60 Firmware
3
Arubaos Switch
3
Oneview
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-76669 | Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authenticated user to raise their permissions to administrative level, resulting in complete compromise of the management plane. Only holders of a valid low-privilege API account with network reachability to the API can trigger it (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), so the practical risk depends on how API accounts are provisioned and whether the management interface is segmented away from untrusted networks. Our assessment scores the issue as scope-unchanged (S:U) rather than the 9.9 / S:C vendor figure, which makes this a genuine high-priority issue rather than a CVSS-inflated one; no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV. Note that the affected version data names EdgeConnect SD-WAN Gateways while the description names the Orchestrator, so the exact affected component should be confirmed against the HPE advisory. | CRITICAL | 9.9 | – | 50 |
No patch
|
| CVE-2026-76670 | Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0) allows an authenticated, low-privileged user of the Orchestrator API to elevate themselves to an administrative role and take full control of the SD-WAN management plane. The issue is network-reachable, low complexity, and needs no user interaction (CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact), but it is not exploitable before authentication, so the realistic attack surface is limited to deployments that hand out Orchestrator accounts - multi-tenant, self-service, or otherwise heavily populated role models, and far less so to single-admin environments. No public exploit code has been identified at time of analysis and the issue is not listed as actively exploited (no CISA KEV entry); the vendor rates it 9.9 with a scope change, while our independent assessment agrees on the impact metrics but scores it without a scope change. | CRITICAL | 9.9 | – | 50 |
No patch
|
| CVE-2026-76672 | Information disclosure in the HPE Aruba EdgeConnect SD-WAN Orchestrator allows a remote attacker holding only a valid read-only account to retrieve sensitive configuration data, including third-party API tokens and credentials, by sending a specially crafted request to the cache synchronization endpoint. The vendor-supplied score of 9.9 reflects a scope-changed vector with high confidentiality and integrity impact, whereas independent reassessment places the realistic impact at confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), because the flaw leaks data rather than altering system state. No CISA KEV entry and no public exploit code were identified at time of analysis, so the practical risk scales with how broadly low-privilege accounts are provisioned and whether the Orchestrator management interface is reachable from untrusted networks. | CRITICAL | 9.9 | – | 50 |
No patch
|
| CVE-2026-76673 | Unauthenticated remote attackers can bypass authentication controls in the EdgeConnect SD-WAN Orchestrator management API to gain administrative privileges and fully compromise the underlying host, rated 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Affected builds per the EUVD advisory span EdgeConnect SD-WAN 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0, although the description attributes the flaw to the Orchestrator while EUVD lists Gateways, so the exact affected component should be confirmed against HPE advisory hpesbnw05135en_us. No public exploit identified at time of analysis and no CISA KEV entry, but the unauthenticated, network-reachable attack path and total confidentiality, integrity, and availability impact make this a top-priority exposure wherever the management API is internet-facing. | CRITICAL | 9.8 | – | 49 |
No patch
|
| CVE-2026-76674 | Unauthenticated remote code execution affects HPE Networking EdgeConnect SD-WAN Gateways running firmware in the 9.4.x, 9.5.x, 9.6.x, and 9.7.0.0 branches, where a buffer overflow in an underlying operating system service permits a network-reachable attacker to run arbitrary commands and fully compromise the appliance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and the independent assessment agree that no credentials or user interaction are needed, so the practical limiting factor is whether the vulnerable interface is reachable from an untrusted network. No public exploit code has been identified at time of analysis and the issue has not been confirmed actively exploited (CISA KEV), but the severity, the network-edge placement of these devices, and the credential-free attack path make this a top-priority patch item for exposed gateways. | CRITICAL | 9.8 | – | 49 |
No patch
|
| CVE-2026-76680 | Server-side request forgery in the EdgeConnect SD-WAN Orchestrator API lets any remote user who already holds valid low-privilege credentials redirect server-side fetches to attacker-chosen internal destinations, mapping the internal structure of the Orchestrator host and disclosing sensitive information beyond that user's authorized privilege level. The issue is network-reachable at low attack complexity with no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5), and the scope change reflects the pivot out of the API context into the host/network fabric. No public exploit code was identified at time of analysis and no CISA KEV entry is associated with this CVE; note that the description names the Orchestrator while the ENISA EUVD record lists EdgeConnect SD-WAN Gateway builds 9.4.0 through 9.7.0, so the exact affected component should be confirmed against the HPE advisory before scoping exposure. | HIGH | 8.5 | – | 42 |
No patch
|
| CVE-2026-73769 | Remote code execution in HPE Aruba ClearPass Policy Manager (CPPM) allows an authenticated attacker with high-privilege access to the web-based management interface to execute arbitrary commands on the underlying operating system. The attack is network-reachable with no user interaction required beyond obtaining administrator credentials. No public exploit has been identified at time of analysis, but full system compromise is achievable upon successful exploitation. | HIGH | 7.2 | 0.9% | 37 |
No patch
|
| CVE-2026-76691 | A buffer overflow in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already holds high-privilege API credentials to execute arbitrary commands as a privileged operating-system user on the gateway appliance. Affected releases span the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, per ENISA EUVD version ranges. The CVSS 3.1 vector requires PR:H, meaning exploitation is not unauthenticated; no public exploit was identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 7.2 | – | 36 |
No patch
|