Critical Vulnerabilities in HPE EdgeConnect SD-WAN Allow Full System Compromise
Hewlett Packard Enterprise has released security updates for critical vulnerabilities in its EdgeConnect SD-WAN Gateways and Orchestrator, including flaws that could allow remote attackers to achieve complete system compromise.
Hewlett Packard Enterprise (HPE) has issued urgent security updates to address a significant number of vulnerabilities discovered in its EdgeConnect SD-WAN Gateways and SD-WAN Orchestrator. The most severe of these flaws, detailed in Security Bulletin HPESBNW05135, could enable remote attackers to gain complete control over affected systems, posing a substantial risk to network operations and sensitive data.
The vulnerabilities primarily target the management interfaces and application programming interfaces (APIs) integral to EdgeConnect SD-WAN deployments. HPE strongly advises customers to implement the available updates without delay to mitigate potential exploitation, which could lead to credential theft, arbitrary command execution, disruption of network services, or full compromise of Orchestrator hosts and gateway appliances.
Among the most critical issues are CVE-2026-76669 and CVE-2026-76670, both rated with a CVSS score of 9.9. These authorization bypass vulnerabilities reside within the EdgeConnect SD-WAN Orchestrator API. A remote attacker with even low-level authenticated access could exploit these flaws to escalate their privileges to an administrator level, granting them extensive control over the system.
Another critical vulnerability, CVE-2026-76672, also carries a CVSS score of 9.9 and affects the Orchestrator. This flaw allows a read-only authenticated user to exploit a cache synchronization endpoint via a specially crafted request. Successful exploitation can lead to the exposure of sensitive configuration information, including third-party API tokens and credentials. The compromise of these credentials could facilitate lateral movement into connected external security platforms.
Furthermore, CVE-2026-76673, a critical API authentication bypass vulnerability in the Orchestrator (CVSS 9.8), could allow unauthenticated remote attackers to bypass authentication mechanisms entirely, gain administrative privileges, and achieve full system compromise without needing a valid account. Complementing this, CVE-2026-76674, a critical vulnerability in EdgeConnect SD-WAN Gateways (CVSS 9.8), involves buffer overflows in the underlying operating system. This could permit unauthenticated remote attackers to execute arbitrary code and commands, potentially leading to complete control of the gateway.
The advisory also enumerates high-severity vulnerabilities, including command injection, buffer overflows, server-side request forgery (SSRF), information disclosure, privilege escalation, and denial-of-service (DoS) flaws. Some of these issues allow authenticated low-privilege users to execute commands with root privileges, while others can be exploited by unauthenticated attackers to crash services or access sensitive system data.
HPE has provided specific patched versions for affected products. For EdgeConnect SD-WAN Gateways, updates are available in ECOS versions 9.7.1.0, 9.6.4.0, 9.5.9.0, and 9.4.9.0 or later. For Orchestrator, users should upgrade to versions 9.7.1, 9.6.4, 9.5.9, or 9.4.11 or later. It is crucial that the Orchestrator version is equal to or newer than the ECOS release running on managed gateways.
As temporary mitigation measures, HPE recommends isolating management interfaces on dedicated network segments, enforcing strict Layer 3 firewall policies, and diligently logging all administrative activity. At the time of the bulletin's release, HPE stated it was unaware of any public exploit code or active exploitation of these vulnerabilities.