CVE-2026-76680: arubanetworks edgeconnect_sd-wan_orchestrator Server-Side Request Forgery (SSRF)

Vulnerability summary

CVE-2026-76680 is a high (CVSS 8.5) Server-Side Request Forgery (SSRF) vulnerability in arubanetworks edgeconnect_sd-wan_orchestrator. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.2% of scored vulnerabilities.

Timeline

1. 15-09-2026
   PublishedVulnerability first disclosed.
2. 21-09-2026
   Last modifiedVulnerability information updated.

Description

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery (SSRF) attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information beyond what is authorized by the user's existing privilege level.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.