CVE-2026-76691

A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways, allowing a remote attacker to execute arbitrary commands as a privileged user on the appliance's underlying operating system. Exploitation requires authentication with high privileges (per the CVSS vector PR:H), so the likely attacker profile is an attacker with stolen or compromised admin-level API credentials, or a malicious insider. Successful exploitation yields full control of the gateway OS, exposing routed traffic, VPN/SD-WAN overlays, and adjacent network segments. The flaw affects HPE Networking EdgeConnect SD-WAN Gateway appliances wherever the affected code is deployed; specific fixed and affected versions are not stated in the source data. There is no known public proof of concept and no indication of in-the-wild exploitation (not on the CISA KEV).

What to do: Apply HPE's patched firmware as specified in the vendor's security bulletin for this CVE, since the affected version range is only defined there. Restrict gateway API and management access to trusted administrative networks or VPN, rotate admin/API credentials, and enforce MFA where supported, since exploitation requires high privileges. Review gateway logs for unexpected privileged command execution or anomalous API activity originating from unfamiliar sources.