CVE-2026-76701: Arubanetworks Edgeconnect SD-WAN Orchestrator

Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking EdgeConnect SD-WAN Gateways.

Affected products

• Arubanetworks Edgeconnect SD-WAN Orchestrator: from 9.4.0, before 9.4.11 (fixed in 9.4.11); from 9.5.0, before 9.5.9 (fixed in 9.5.9); from 9.6.0, before 9.6.4 (fixed in 9.6.4); version 9.7.0 only
• HPE Edgeconnect Operating System: from 9.4.0.0, before 9.4.9.0 (fixed in 9.4.9.0); from 9.5.0.0, before 9.5.9.0 (fixed in 9.5.9.0); from 9.6.0.0, before 9.6.4.0 (fixed in 9.6.4.0); version 9.7.0.0 only

Published 2026-09-15. Last modified 2026-09-28.