CVE-2026-76677

Last refreshed2026-10-12

Status: UPDATED | Advisory ID: CVE-2026-76677

Key Details

CVE	CVE-2026-76677
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-09-28
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	arubanetworks edgeconnect_sd-wan_orchestrator, hpe edgeconnect_operating_system, and Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways
Classified as	CWE-269 (Improper Privilege Management)

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
arubanetworks	edgeconnect_sd-wan_orchestrator
hpe	edgeconnect_operating_system
Hewlett Packard Enterprise (HPE)	EdgeConnect SD-WAN Gateways

Vendor

Product

Affected Versions

Patch Status

arubanetworks

edgeconnect_sd-wan_orchestrator

hpe

edgeconnect_operating_system

Hewlett Packard Enterprise (HPE)

EdgeConnect SD-WAN Gateways

Subsystems	General OT
Sectors	Multiple

What to Know

A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways. Successful exploitation could allow a remote low-privileged authenticated user to achieve administrative privilege on the web-management interface leading to complete system compromise. (NVD)

What to Do

Monitor arubanetworks, hpe, and Hewlett Packard Enterprise (HPE)'s web pages for any future patch releases. See vendor advisory link below.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-76677
CVE	https://www.cve.org/CVERecord?id=CVE-2026-76677
Vendor advisory	https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-76677

CVE

https://www.cve.org/CVERecord?id=CVE-2026-76677

Vendor advisory