Do Son 
Hewlett Packard Enterprise (HPE) released an urgent security advisory on September 15, 2026, revealing a critical HPE EdgeConnect authorization bypass. This severe vulnerability, carrying a near-maximum CVSS score of 9.9, affects the SD-WAN Orchestrator API. Remote attackers can exploit this flaw to escalate privileges and achieve complete system compromise. System administrators must deploy the provided patches immediately.
- Total: 4 CVEs
- Severity: 4 Critical
- Actively exploited: None confirmed
- Highest severity: 9.9 (Critical · CVSSv3) — CVE-2026-76670
- Action: Apply the latest security updates now
Track every CVE that hits your stack the moment it's exploited.
Get free email alertsNotable CVEs
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-76670 | 9.9 | Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator | Not exploited |
| CVE-2026-76669 | 9.9 | Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator | Not exploited |
| CVE-2026-76673 | 9.8 | Authentication Bypass in API of EdgeConnect SD-WAN Orchestrator | Not exploited |
| CVE-2026-76674 | 9.8 | Unauthenticated Buffer Overflow lead to Remote Code Execution in HPE Networking | Not exploited |
Why This Threat Matters
Thousands of enterprises rely on HPE Networking EdgeConnect SD-WAN Orchestrator to manage distributed network infrastructures. Therefore, vulnerabilities within this core management platform pose an exceptional risk to corporate networks worldwide. If an attacker exploits this HPE EdgeConnect authorization bypass, they can assume administrative control. Consequently, intruders could intercept sensitive network traffic, alter routing configurations, and compromise connected SD-WAN Gateways across the organization.
How the Attack Works
The critical vulnerability resides within the application programming interface (API) of the SD-WAN Orchestrator. The vendor advisory explains: “Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user.”
The attacker first authenticates with low-level privileges. Then, they send specially crafted requests to the vulnerable API endpoints. These requests bypass standard authorization checks, allowing the attacker to assume administrative rights. A second, identical vulnerability (CVE-2026-76669) exists within the same component. Additionally, CVE-2026-76673 allows unauthenticated remote actors to circumvent authentication controls completely, leading to a CVSS 9.8 severity rating. Currently, HPE is not aware of any public exploit code targeting these vulnerabilities.
Affected Versions
These vulnerabilities impact multiple releases of the HPE Networking EdgeConnect SD-WAN Orchestrator. The affected software versions include all 9.7.x releases up to 9.7.0, 9.6.x releases up to 9.6.3, 9.5.x releases up to 9.5.8, and 9.4.x releases up to 9.4.10.
Patch and Mitigation Steps
Administrators must immediately upgrade their SD-WAN Orchestrator instances to secure their networks. HPE recommends updating to versions 9.7.1, 9.6.4, 9.5.9, or 9.4.11, depending on the current deployment branch. Users can access detailed update instructions in the official HPE Networking security advisory. If an immediate upgrade is not feasible, restrict the web-based management interfaces to dedicated, secured VLANs.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
