CVE-2026-76670: arubanetworks edgeconnect_sd-wan_orchestrator Improper Privilege Management

Vulnerability summary

CVE-2026-76670 is a critical (CVSS 9.9) Improper Privilege Management vulnerability in arubanetworks edgeconnect_sd-wan_orchestrator. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.3% of scored vulnerabilities.

Timeline

1. 15-09-2026
   PublishedVulnerability first disclosed.
2. 21-09-2026
   Last modifiedVulnerability information updated.

Description

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.