CVE-2026-76678

Last refreshed2026-10-12

Status: UPDATED | Advisory ID: CVE-2026-76678

Key Details

CVE	CVE-2026-76678
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-09-28
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	arubanetworks edgeconnect_sd-wan_orchestrator, hpe edgeconnect_operating_system, and Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways
Classified as	CWE-269 (Improper Privilege Management)

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
arubanetworks	edgeconnect_sd-wan_orchestrator
hpe	edgeconnect_operating_system
Hewlett Packard Enterprise (HPE)	EdgeConnect SD-WAN Gateways

Vendor

Product

Affected Versions

Patch Status

arubanetworks

edgeconnect_sd-wan_orchestrator

hpe

edgeconnect_operating_system

Hewlett Packard Enterprise (HPE)

EdgeConnect SD-WAN Gateways

Subsystems	General OT
Sectors	Multiple

What to Know

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system. (NVD)

What to Do

Monitor arubanetworks, hpe, and Hewlett Packard Enterprise (HPE)'s web pages for any future patch releases. See vendor advisory link below.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-76678
CVE	https://www.cve.org/CVERecord?id=CVE-2026-76678
Vendor advisory	https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-76678

CVE

https://www.cve.org/CVERecord?id=CVE-2026-76678

Vendor advisory