CVE-2026-76704

MediumCVSS 5.5/10Last modified Sep 25, 2026

Description

A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Successful exploitation could allow an attacker to access sensitive information, potentially affecting the confidentiality and integrity of the data processed by the application.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)EdgeConnect SD-WAN Gateways>= 9.7.0, <= 9.7.0; >= 9.6.0, <= 9.6.3; >= 9.5.0, <= 9.5.8; >= 9.4.0, <= 9.4.10

References

Timeline

Published
Sep 15, 2026
Last modified
Sep 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-767055.5A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could alloCVE-2026-767065.3A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtaCVE-2026-767074.3A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to view some system memory coCVE-2026-767089.8A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coCVE-2026-767099.8A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnCVE-2026-76713.7A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of theCVE-2026-767107.5A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive informCVE-2026-767117.5A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket cCVE-2026-767127.3A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial CVE-2026-767137.2A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vulnCVE-2026-767147.2Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlCVE-2026-767157.1A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Su
CVE-2026-76704: Medium severity, CVSS 5.5 | Vulnix