CVE-2026-44878: Authenticated Path Traversal allows Unauthorized Access in Web Interface
Vulnerability summary
CVE-2026-44878 is a high (CVSS 7.2) Insecure Temporary File vulnerability in hewlett packard enterprise (hpe) edgeconnect sd-wan gateway (ecos). EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.9% of scored vulnerabilities.
Timeline
- 21-07-2026PublishedVulnerability first disclosed.
- 23-07-2026Last modifiedVulnerability information updated.
Description
A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.60% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-377Insecure Temporary FileCreating and using insecure temporary files can leave application and system data vulnerable to attack.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Hewlett packard enterprise (hpe)1 product
- edgeconnect sd-wan gateway (ecos)≥ 9.4.0.0, ≤ 9.4.6.0 | ≥ 9.5.0.0, ≤ 9.5.6.0 | ≥ 9.6.0.0, ≤ 9.6.1.0
1 vendor · 1 product