CVE-2026-76680

HighCVSS 8.5/10Last modified Sep 25, 2026

Description

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery (SSRF) attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information beyond what is authorized by the user's existing privilege level.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)EdgeConnect SD-WAN Gateways>= 9.7.0, <= 9.7.0; >= 9.6.0, <= 9.6.3; >= 9.5.0, <= 9.5.8; >= 9.4.0, <= 9.4.10

References

Timeline

Published
Sep 15, 2026
Last modified
Sep 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-766818.5A vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access senCVE-2026-766828.2A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker tCVE-2026-766838.1Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated CVE-2026-766848.1Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthentiCVE-2026-766858.1A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated iCVE-2026-766867.5A vulnerability exists in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allowCVE-2026-766877.5A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacCVE-2026-766887.5Vulnerabilities have been identified in the web-based management interface of EdgeConnect SD-WAN Orchestrator that could potentially allow aCVE-2026-766897.2A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed. An autCVE-2026-76695.6A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hCVE-2026-766907.2A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An aCVE-2026-766917.2Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow