Critical HPE Vulnerabilities Allow Remote Attackers to Achieve Complete System Compromise

CVE-2026-76669 is a critical (CVSS 3.1: 9.9) privilege escalation vulnerability in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. It is triggered remotely by a low-privileged authenticated user sending crafted requests to the affected API, exploiting flaws that let them elevate their rights to those of an administrative user. Successful exploitation grants full administrative control of the orchestrator, which HPE states leads to complete system compromise — and, given the orchestrator's role, potentially control over the SD-WAN fabric it manages. Any organization running an affected EdgeConnect SD-WAN Orchestrator deployment with multiple user accounts is exposed to risk, particularly where low-privileged or tenant-level API access exists. No public proof-of-concept is known and the flaw is not listed in CISA's KEV catalog, so exploitation status is currently none known.

Do: Apply the patched versions specified in HPE's security bulletin for EdgeConnect SD-WAN Orchestrator as soon as it is available. In the interim, restrict orchestrator API and management access to trusted VPN/administrative networks, audit and minimize low-privileged and tenant-level accounts with API access, and review authentication and privilege-change logs for anomalous activity. Rotate administrative credentials if any suspicious privilege elevation is observed.

CVE-2026-76672 is a critical (CVSS 9.9) information disclosure flaw in HPE's SD-WAN Orchestrator affecting the cache synchronization endpoint. An authenticated remote attacker holding only read-only privileges can send a specially crafted request to that endpoint, which returns sensitive configuration data without further authorization checks. Successful exploitation discloses third-party API tokens and credentials, which could enable lateral movement into external security platforms integrated with the orchestrator. The vulnerability affects HPE SD-WAN Orchestrator deployments exposed to authenticated users; no specific version ranges were provided in the advisory data. There is no known public proof of concept and the flaw is not on CISA's KEV list, so exploitation status is currently none known.

Do: Apply the patched release identified in HPE's security bulletin for the SD-WAN Orchestrator as soon as it is available. Restrict orchestrator management access to trusted admin networks or VPN, and audit logs for unusual requests to the cache synchronization endpoint from read-only accounts. Rotate any third-party API tokens and credentials configured on the orchestrator, since exposed secrets could enable lateral movement to connected security platforms.

CVE-2026-76673 is an authentication-bypass flaw in the API of HPE Aruba Networking's EdgeConnect SD-WAN Orchestrator that lets an unauthenticated remote attacker circumvent existing authentication controls over the network, with no privileges or user interaction required (CVSS 3.1: 9.8). Successful exploitation grants the attacker administrative privileges on the Orchestrator, which amounts to complete compromise of the Orchestrator host and, by extension, potential control over the managed SD-WAN fabric. Any organization operating an EdgeConnect SD-WAN Orchestrator (on-premises or provider/cloud-hosted) is affected, particularly instances whose API interface is reachable from untrusted networks. No public proof-of-concept is known, the flaw is not on CISA's KEV list, and there are no reports of in-the-wild exploitation as of this analysis. The high severity and network-exploitable nature still make patching urgent for exposed deployments.

Do: Apply HPE's patch immediately per the Aruba Networking security advisory and confirm your Orchestrator version against the affected/fixed list. Until patched, restrict Orchestrator API and management access to trusted networks or VPN and enforce allow-listing at edge firewalls. Review Orchestrator and host logs for unexplained unauthenticated API activity or new admin accounts, and rotate credentials and API keys if compromise is suspected.

CVE-2026-76674 is a critical (CVSS 9.8) buffer overflow vulnerability in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways (EdgeConnect OS/ECOS appliances). It is triggered remotely over the network with no authentication, no privileges, and no user interaction required, and successful exploitation allows an attacker to execute arbitrary commands on the gateway's OS, leading to complete system compromise of the appliance. Affected parties are enterprises and service providers operating HPE EdgeConnect SD-WAN branch or data-center gateways, especially any with management or data-plane services reachable from untrusted networks. Because gateways sit at the network edge, compromise can enable traffic interception or pivoting into internal corporate networks. No public proof of concept is known and the flaw is not in CISA's KEV catalog, so no active exploitation has been reported to date.

Do: Apply the patched EdgeConnect OS release specified in HPE's security bulletin to all affected gateways as soon as it is available (the exact fixed version must be taken from the HPE advisory, as it is not stated here). In the interim, restrict gateway management and service ports to trusted orchestrator/admin networks using firewall rules or ACLs, and run external scans to confirm none of your gateways are internet-reachable. Monitor gateway logs, the HPE advisory, and the CISA KEV catalog for signs of exploitation.