CVE-2026-76704
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
15/09/2026
Last modified:
25/09/2026
Description
A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Successful exploitation could allow an attacker to access sensitive information, potentially affecting the confidentiality and integrity of the data processed by the application.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:* | 9.4.0 (including) | 9.4.11 (excluding) |
| cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:* | 9.5.0 (including) | 9.5.9 (excluding) |
| cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:* | 9.6.0 (including) | 9.6.4 (excluding) |
| cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.7.0:*:*:*:*:*:*:* | ||
| cpe:2.3:o:hpe:edgeconnect_operating_system:*:*:*:*:*:*:*:* | 9.4.0.0 (including) | 9.4.9.0 (excluding) |
| cpe:2.3:o:hpe:edgeconnect_operating_system:*:*:*:*:*:*:*:* | 9.5.0.0 (including) | 9.5.9.0 (excluding) |
| cpe:2.3:o:hpe:edgeconnect_operating_system:*:*:*:*:*:*:*:* | 9.6.0.0 (including) | 9.6.4.0 (excluding) |
| cpe:2.3:o:hpe:edgeconnect_operating_system:9.7.0.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page