Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by hpe

CVE-2026-76706Unauthenticated Information Disclosure in EdgeConnect SD-WAN Orchestrator API allows exposure of sensitive data

Medium 5.3

In plain English

A medium-severity information exposure in EdgeConnect SD-WAN Gateways from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 63.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could result in the disclosure of security-relevant configuration details and security feature status, which could be used to facilitate further attacks.

Affected products (as reported)

VendorProductVersions
Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways 9.7.0 – through 9.7.09.6.0 – through 9.6.39.5.0 – through 9.5.89.4.0 – through 9.4.10

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References