CVE-2026-76698CWE-77command-injection

CVE-2026-76698

Medium · published September 16, 2026

CVSS v3.1
6.5
EPSS
5%
Percentile
91.5
In the wild
Unconfirmed
What it is

A command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker with limited access privileges could exploit this vulnerability through specially crafted input. Successful exploitation, under certain conditions, could result in the execution of arbitrary commands with elevated privileges or a denial-of-service condition on the affected appliance.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.04534 · 91.5th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-09-16T00:17Z
Affected products (8)
ProductVersionsFixed in
arubanetworks/edgeconnect_sd-wan_orchestrator≥ 9.4.0, < 9.4.119.4.11
arubanetworks/edgeconnect_sd-wan_orchestrator≥ 9.5.0, < 9.5.99.5.9
arubanetworks/edgeconnect_sd-wan_orchestrator≥ 9.6.0, < 9.6.49.6.4
arubanetworks/edgeconnect_sd-wan_orchestratorall versions—
hpe/edgeconnect_operating_system≥ 9.4.0.0, < 9.4.9.09.4.9.0
hpe/edgeconnect_operating_system≥ 9.5.0.0, < 9.5.9.09.5.9.0
hpe/edgeconnect_operating_system≥ 9.6.0.0, < 9.6.4.09.6.4.0
hpe/edgeconnect_operating_systemall versions—
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 17 SEP 03:32Z
    EPSS moved — → 4%
    epss
  • 15 SEP 19:23Z
    Authenticated Command Injection Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways
    cvelistv5