CVE-2026-76698
Severity CVSS v4.0:
Pending analysis
Type:
CWE-77
Command Injection
Publication date:
15/09/2026
Last modified:
28/09/2026
Description
A command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker with limited access privileges could exploit this vulnerability through specially crafted input. Successful exploitation, under certain conditions, could result in the execution of arbitrary commands with elevated privileges or a denial-of-service condition on the affected appliance.
Impact
Base Score 3.x
6.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:* | 9.4.0 (including) | 9.4.11 (excluding) |
| cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:* | 9.5.0 (including) | 9.5.9 (excluding) |
| cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:* | 9.6.0 (including) | 9.6.4 (excluding) |
| cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.7.0:*:*:*:*:*:*:* | ||
| cpe:2.3:o:hpe:edgeconnect_operating_system:*:*:*:*:*:*:*:* | 9.4.0.0 (including) | 9.4.9.0 (excluding) |
| cpe:2.3:o:hpe:edgeconnect_operating_system:*:*:*:*:*:*:*:* | 9.5.0.0 (including) | 9.5.9.0 (excluding) |
| cpe:2.3:o:hpe:edgeconnect_operating_system:*:*:*:*:*:*:*:* | 9.6.0.0 (including) | 9.6.4.0 (excluding) |
| cpe:2.3:o:hpe:edgeconnect_operating_system:9.7.0.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page