Medium severity · published Sep 15, 2026
CVE-2026-76698
Authenticated Command Injection Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways
6.5
CVSS
4.5%
EPSS
No
On KEV
Description
A command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker with limited access privileges could exploit this vulnerability through specially crafted input. Successful exploitation, under certain conditions, could result in the execution of arbitrary commands with elevated privileges or a denial-of-service condition on the affected appliance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.5% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
EdgeConnect SD-WAN Gateways · Hewlett Packard Enterprise (HPE)
9.7.0.0 through 9.7.0.0; 9.6.0.0 through 9.6.3.1; 9.5.0.0 through 9.5.8.1; 9.4.0.0 through 9.4.8.2 · source: vendor
EO
Edgeconnect Operating System · Hpe
9.4.0.0 before 9.4.9.0; 9.5.0.0 before 9.5.9.0; 9.6.0.0 before 9.6.4.0; 9.7.0.0 · source: NVD
ES
Edgeconnect Sd-wan Orchestrator · Arubanetworks
9.4.0 before 9.4.11; 9.5.0 before 9.5.9; 9.6.0 before 9.6.4; 9.7.0 · source: NVD
Affected product
ES
EdgeConnect SD-WAN Gateways
Hewlett Packard Enterprise (HPE)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76698
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76698
Vendor Advisory
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US
More from EdgeConnect SD-WAN Gateways
9.9
CVE-2026-76672
Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator
9.9
CVE-2026-76670
Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator
9.9
CVE-2026-76669
Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator
9.8
CVE-2026-76674
Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways
9.8
CVE-2026-76673
Authentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN Orchestrator