Hewlett Packard Enterprise has identified a suite of severe vulnerabilities in its EdgeConnect SD-WAN Gateways and Orchestrator components that could let remote attackers seize full control over affected systems. Published in Security Bulletin HPESBNW05135 on September 15, 2026, the defects are mainly concentrated in management interfaces and APIs. HPE urges immediate patching to prevent exposure of credentials, arbitrary command execution, or complete system takeover.
The Critical Flaws at a Glance
Among the most alarming weaknesses are CVE-2026-76669and CVE-2026-76670, which both allow low‐privilege authenticated users to bypass authorization and elevate privileges to administrator status through Orchestrator APIs. Each has been assigned a CVSS score of 9.9.
CVE-2026-76672enables even read-only authenticated users to extract highly sensitive data. By targeting a cache synchronization endpoint via the Orchestrator, attackers can exfiltrate tokens and credentials belonging to third-party APIs. This vulnerability also carries a 9.9 CVSS rating.
Also serious is CVE-2026-76673, an authentication bypass issue in the Orchestrator API that allows unauthenticated attackers to obtain administrator privileges and fully compromise the host without needing a valid account. Its CVSS rating is 9.8.
On the Gateway side, CVE-2026-76674involves stack buffer overflows in the device’s underlying OS. It allows unauthenticated remote attackers to run arbitrary code on the gateway and potentially take over the appliance. Also rated 9.8.
Scope, Fixes, and Mitigation
All EdgeConnect SD-WAN Gateways running ECOS version 9.7.0.0 or earlier, 9.6.3.1 or earlier, 9.5.8.1 or earlier, and 9.4.8.2 or earlier are affected. As for Orchestrator, impacted versions include 9.7.0 and older, 9.6.3 and older, 9.5.8 and older, and 9.4.10 or earlier.
A fix has been released: Gateway updates starting with ECOS 9.7.1.0, 9.6.4.0, 9.5.9.0, and 9.4.9.0 or later eliminate the vulnerabilities. Orchestrator patches begin with version 9.7.1, 9.6.4, 9.5.9, or 9.4.11 or later. Additionally, HPE requires that the Orchestrator version be at least as current as the ECOS release running on any managed gateways.
While fixes are available, HPE also recommends interim defensive actions: isolate management interfaces on dedicated Layer-2 segments or VLANs, enforce Layer-3 firewall restrictions, and log all administrator activities. As of the bulletin’s release, there’s no evidence that these vulnerabilities have been exploited in the wild or are supported by public exploit code.
Why It Matters:These flaws threaten trust in edge networking infrastructure. SD-WAN gateways and orchestrators are vital for remote and branch office connectivity—access into them often grants entry deep into corporate networks. With such high severity ratings and easy paths to full control, attackers exploiting these could launch destructive attacks, data exfiltration, or lateral movement at scale.
