CVE-2026-76684

CVE-2026-76684 is a flaw in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that allows an unauthenticated remote attacker to circumvent the product's authentication controls. Exploitation is triggered over the network by sending specially crafted requests to the vulnerable API without valid credentials, though the CVSS vector (AV:N/AC:H) indicates exploit complexity is high, meaning the attack likely requires specific conditions or timing. A successful attacker gains administrative privileges, resulting in complete compromise of the EdgeConnect SD-WAN Orchestrator host, and by extension visibility and control over the managed SD-WAN environment. Affected parties are enterprises and service providers running HPE (formerly Aruba/Silver Peak) EdgeConnect SD-WAN Orchestrator, whether on-premises or cloud-hosted. There is no known public proof-of-concept and no indication of in-the-wild exploitation at this time (not in CISA KEV).

What to do: Apply the patched release specified in HPE's security bulletin for EdgeConnect SD-WAN Orchestrator as soon as it is available, since the flaw is unauthenticated and yields full host compromise. Until patched, restrict orchestrator API and management access to trusted VPN or internal management networks and enforce strict firewall/ACL rules, as well as MFA for administrative access where supported. Review orchestrator and API logs for unexplained unauthenticated requests, anomalous admin-level changes, or new administrative accounts, and monitor HPE advisories and CISA KEV for updated exploitation signals.