CVE-2026-76706
published 2026-09-15CVE-2026-76706: A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.42%
33.8th percentile
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could result in the disclosure of security-relevant configuration details and security feature status, which could be used to facilitate further attacks.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arubanetworks | edgeconnect_sd-wan_orchestrator | — | — |
| arubanetworks | edgeconnect_sd-wan_orchestrator | >= 9.4.0 < 9.4.11 | 9.4.11 |
| arubanetworks | edgeconnect_sd-wan_orchestrator | >= 9.5.0 < 9.5.9 | 9.5.9 |
| arubanetworks | edgeconnect_sd-wan_orchestrator | >= 9.6.0 < 9.6.4 | 9.6.4 |
| hewlett_packard_enterprise | edgeconnect_sd-wan_gateways | 9.4.0 – 9.4.10 | — |
| hewlett_packard_enterprise | edgeconnect_sd-wan_gateways | 9.5.0 – 9.5.8 | — |
| hewlett_packard_enterprise | edgeconnect_sd-wan_gateways | 9.6.0 – 9.6.3 | — |
| hewlett_packard_enterprise | edgeconnect_sd-wan_gateways | 9.7.0 – 9.7.0 | — |
| hpe | edgeconnect_operating_system | — | — |
| hpe | edgeconnect_operating_system | >= 9.4.0.0 < 9.4.9.0 | 9.4.9.0 |
| hpe | edgeconnect_operating_system | >= 9.5.0.0 < 9.5.9.0 | 9.5.9.0 |
| hpe | edgeconnect_operating_system | >= 9.6.0.0 < 9.6.4.0 | 9.6.4.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information.
ghsa_unreviewed·2026-09-15
CVE-2026-76706 [MEDIUM] CWE-200 A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information.
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could result in the disclosure of security-relevant configuration details and security feature status, which could be used to facilitate further attacks.
VulDB
HPE EdgeConnect SD-WAN Gateways up to 9.4.10/9.5.8/9.6.3/9.7.0 API Endpoint information disclosure (EUVD-2026-79232)
vuldb·2026-09-15·CVSS 5.3
CVE-2026-76706 [MEDIUM] HPE EdgeConnect SD-WAN Gateways up to 9.4.10/9.5.8/9.6.3/9.7.0 API Endpoint information disclosure (EUVD-2026-79232)
A vulnerability classified as problematic has been found in HPE EdgeConnect SD-WAN Gateways up to 9.4.10/9.5.8/9.6.3/9.7.0. This vulnerability affects unknown code of the component API Endpoint. The manipulation leads to information disclosure.
This vulnerability is uniquely identified as CVE-2026-76706. The attack is possible to be carried out remotely. No exploit exists.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-15
Published