CVE-2026-76690

CVE-2026-76690 is an arbitrary command execution flaw in a component of the HPE Networking EdgeConnect SD-WAN Gateway (formerly Aruba/Silver Peak EdgeConnect). A remote attacker who already possesses valid credentials can submit specially crafted input to the affected component, and successful exploitation results in remote code execution as root on the gateway appliance. Because it requires high privileges (PR:H per the CVSS 3.1 vector, scored 7.2), the primary risk is credential-compromised insiders, brute-forced or leaked admin accounts, or attackers chaining with an auth-bypass flaw. Organizations running EdgeConnect SD-WAN gateways at branch, data center, or cloud edge sites are affected. There is no known public proof of concept and no indication of exploitation in the wild; the CVE is not on the CISA KEV list.

What to do: Apply the patched firmware versions identified in HPE's security bulletin for EdgeConnect SD-WAN gateways as soon as releases are available. Since exploitation requires valid credentials, restrict management and orchestration interfaces to trusted admin networks or VPN, enforce strong unique credentials with MFA where supported, and rotate admin accounts. Review gateway audit logs for anomalous administrative sessions or unexpected command execution and validate that only expected accounts exist.