Vulnerability · Published Sep 15, 2026 · Assigned by hpe
CVE-2026-76672Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator
Critical 9.9
In plain English
A critical-severity information exposure in EdgeConnect SD-WAN Gateways from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint. Successful exploitation could result in the disclosure of sensitive third-party API tokens and credentials, potentially enabling lateral movement to external security platforms.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise (HPE) | EdgeConnect SD-WAN Gateways | 9.7.0 – through 9.7.09.6.0 – through 9.6.39.5.0 – through 9.5.89.4.0 – through 9.4.10 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L