HPE Fixes Critical SD-WAN Flaws Enabling Remote Admin Access

Hewlett Packard Enterprise (HPE) issued an urgent advisory on 15 September 2026 covering four critical vulnerabilities in its Networking EdgeConnect SD-WAN Orchestrator. The most serious, CVE-2026-76670 and CVE-2026-76669, are authorization-bypass flaws rated CVSS 9.9. HPE says a remote, low-privileged authenticated user could exploit specially crafted API requests to bypass authorisation checks and gain administrative privileges.

CVE-2026-76673, rated 9.8, allows unauthenticated remote attackers to bypass API authentication, while CVE-2026-76674, also rated 9.8, is described as an unauthenticated buffer overflow leading to remote code execution in HPE Networking. The article says no exploitation has been confirmed and HPE is not aware of public exploit code.

Affected Orchestrator releases include all 9.7.x versions up to 9.7.0, 9.6.x up to 9.6.3, 9.5.x up to 9.5.8, and 9.4.x up to 9.4.10. Successful attacks against the management platform could give an intruder administrative control, potentially allowing changes to routing and access to connected SD-WAN gateways, although the article presents these as possible consequences rather than reported incidents. HPE recommends upgrading to 9.7.1, 9.6.4, 9.5.9 or 9.4.11, according to the deployment branch. Where an immediate upgrade is not possible, administrators should restrict web-based management interfaces to dedicated, secured VLANs.