CVE-2026-76704

published 2026-09-15

CVE-2026-76704: A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary…

Priority P4 32 medium 5.5 CVSS 3.1

AV N AC L PR H UI N S C C L I L A N

A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Successful exploitation could allow an attacker to access sensitive information, potentially affecting the confidentiality and integrity of the data processed by the application.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
arubanetworks	edgeconnect_sd-wan_orchestrator	—	—
arubanetworks	edgeconnect_sd-wan_orchestrator	>= 9.4.0 < 9.4.11	9.4.11
arubanetworks	edgeconnect_sd-wan_orchestrator	>= 9.5.0 < 9.5.9	9.5.9
arubanetworks	edgeconnect_sd-wan_orchestrator	>= 9.6.0 < 9.6.4	9.6.4
hewlett_packard_enterprise	edgeconnect_sd-wan_gateways	9.4.0 – 9.4.10	—
hewlett_packard_enterprise	edgeconnect_sd-wan_gateways	9.5.0 – 9.5.8	—
hewlett_packard_enterprise	edgeconnect_sd-wan_gateways	9.6.0 – 9.6.3	—
hewlett_packard_enterprise	edgeconnect_sd-wan_gateways	9.7.0 – 9.7.0	—
hpe	edgeconnect_operating_system	—	—
hpe	edgeconnect_operating_system	>= 9.4.0.0 < 9.4.9.0	9.4.9.0
hpe	edgeconnect_operating_system	>= 9.5.0.0 < 9.5.9.0	9.5.9.0
hpe	edgeconnect_operating_system	>= 9.6.0.0 < 9.6.4.0	9.6.4.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79