Hewlett Packard Enterprise Releases Update for Multiple Critical Vulnerabilities in SD-WAN Products

Hewlett Packard Enterprise has released an update due to numerous vulnerabilities found in its HPE Networking EdgeConnect SD-WAN Gateways and SD-WAN Orchestrator. The security advisory published on September 15, 2026, disclosed 39 vulnerabilities based on CVE identifiers, including issues such as privilege escalation, authentication bypass, buffer overflow, command injection, information leakage, and denial of service.

Among the vulnerabilities, six have been classified as critical, the highest severity level. Specifically, CVE-2026-76669 and CVE-2026-76670 highlight privilege escalation vulnerabilities in the API of the SD-WAN Orchestrator. If exploited by a remote authenticated user with low privileges, these vulnerabilities could allow the user to gain administrative rights and potentially compromise the entire system.

CVE-2026-76672 presents a risk of leaking highly sensitive configuration information such as API tokens and credentials from external services. This vulnerability can be exploited if read permissions are granted, allowing a remote attacker to send crafted requests to the cache synchronization endpoint.

All three of these vulnerabilities have been assigned a base score of 9.9 in the Common Vulnerability Scoring System version 3.1 (CVSSv3.1). Additionally, CVE-2026-76673 allows for an authentication bypass to compromise the SD-WAN Orchestrator, while CVE-2026-76674 poses a risk of executing arbitrary code without authentication on the SD-WAN Gateways, both rated with a base score of 9.8.