Critical HPE Vulnerabilities Allow Remote Attackers to Achieve Complete System Compromise
HPE patched critical EdgeConnect SD-WAN flaws, including CVSS 9.8 unauthenticated API bypass and gateway RCE, enabling full system compromise.
HPE Security Bulletin HPESBNW05135 covers critical flaws in EdgeConnect SD-WAN Orchestrator and Gateways: CVE-2026-76669 and CVE-2026-76670 (CVSS 9.9 authorization bypass/privilege escalation), CVE-2026-76672 (CVSS 9.9, leaks third-party API tokens and credentials), CVE-2026-76673 (CVSS 9.8, unauthenticated Orchestrator API authentication bypass granting administrative privileges), and CVE-2026-76674 (CVSS 9.8, unauthenticated buffer overflow enabling arbitrary code execution on gateways). Fixes are available in ECOS 9.7.1.0/9.6.4.0/9.5.9.0/9.4.9.0 and Orchestrator 9.7.1/9.6.4/9.5.9/9.4.11 or later. HPE reported no public exploit code or active exploitation at publication and recommends isolating management interfaces on a dedicated VLAN.
- CVE-2026-76673: unauthenticated Orchestrator API bypass grants admin and full host compromise
- CVE-2026-76674: unauthenticated buffer overflow enables arbitrary code execution on SD-WAN gateways
- CVE-2026-76672: read-only users can steal third-party API tokens and credentials
- Fixes in ECOS 9.7.1.0+ and Orchestrator 9.7.1+; no exploitation reported yet
- HPE recommends isolating management interfaces on a dedicated VLAN with Layer 3 firewall policies
- Tags
- authentication-bypassbuffer-overflowedgeconnecthpeinformation-disclosureprivilege-escalationrcesd-wan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-76669+4 related CVEs | Authenticated Privilege Escalation in HPE EdgeConnect SD-WAN Orchestrator API | 9.9 group max | — |
From the original article
2 min read at cybersecuritynews.com
Hewlett Packard Enterprise has released security updates for HPE Networking EdgeConnect SD-WAN Gateways and SD-WAN Orchestrator after identifying dozens of vulnerabilities, including critical flaws that could let remote attackers take full control of affected systems. HPE tracks the issues in Security Bulletin HPESBNW05135, published on September 15, 2026. The most severe vulnerabilities affect the management […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.