CVE-2026-76680

HighCVSS 8.5/10Last modified Sep 25, 2026

Description

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery (SSRF) attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information beyond what is authorized by the user's existing privilege level.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2026
Last modified: Sep 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-766818.5A vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sen CVE-2026-766828.2A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker t CVE-2026-766838.1Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated CVE-2026-766848.1Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenti CVE-2026-766858.1A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated i CVE-2026-766867.5A vulnerability exists in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow CVE-2026-766877.5A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attac CVE-2026-766887.5Vulnerabilities have been identified in the web-based management interface of EdgeConnect SD-WAN Orchestrator that could potentially allow a CVE-2026-766897.2A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed. An aut CVE-2026-76695.6A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/h CVE-2026-766907.2A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An a CVE-2026-766917.2Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow