← All Advisories

CVE-2026-76690

Last refreshed2026-10-12

Status: UPDATED  |  Advisory ID: CVE-2026-76690

Key Details

CVECVE-2026-76690
CVSS Score / Version
7.2 (High) / CVSS v3.1
Updated2026-09-28
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Prose
attack vector is network; attack complexity is low; privileges required is high; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
arubanetworks edgeconnect_sd-wan_orchestrator, hpe edgeconnect_operating_system, and Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways
Classified as
CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
arubanetworksedgeconnect_sd-wan_orchestrator
hpeedgeconnect_operating_system
Hewlett Packard Enterprise (HPE)EdgeConnect SD-WAN Gateways
SubsystemsGeneral OT
SectorsMultiple

What to Know

A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An authenticated remote attacker could exploit this vulnerability by providing a specially crafted input to the affected component. Successful exploitation could result in remote code execution as root. (NVD)

What to Do

Monitor arubanetworks, hpe, and Hewlett Packard Enterprise (HPE)'s web pages for any future patch releases. See vendor advisory link below.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-76690
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-76690
Vendor advisoryhttps://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US

About

OT-Advisories  ·  CVE  ·  NVD  ·  CVSS  ·  KEV  ·  EPSS  ·  CWE