CVE-2026-76681

Authenticated Information Disclosure Vulnerability in HPE Networking EdgeConnect SD-WAN Orchestrator API

State: Published
Severity: 8.5 High
Published: Sep 15, 2026
Updated: Sep 21, 2026
Reserved: Aug 19, 2026

Description

A vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by EdgeConnect SD-WAN Orchestrator.

Scores

CVSS	Score	Vector	Source
3.1	8.5 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N	hpe

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
EdgeConnect SD-WAN GatewaysHewlett Packard Enterprise (HPE)	9.7.0 through 9.7.0Affected 9.6.0 through 9.6.3Affected 9.5.0 through 9.5.8Affected 9.4.0 through 9.4.10Affected

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.