HEWLETT Packard Enterprise (HPE) issued a security advisory on 15 September 2026 covering four critical vulnerabilities in the API of its Networking EdgeConnect SD-WAN Orchestrator. The most severe, CVE-2026-76670 and the related CVE-2026-76669, are authorization bypass flaws rated CVSS 9.9. HPE says a remote, low-privileged authenticated user could exploit specially crafted API requests to evade authorisation checks and gain administrative privileges.
CVE-2026-76673, rated 9.8, allows unauthenticated remote actors to bypass authentication, while CVE-2026-76674, also rated 9.8, is described as an unauthenticated buffer overflow leading to remote code execution in HPE Networking. No active exploitation or public exploit code has been confirmed.
Affected releases include 9.7.x up to 9.7.0, 9.6.x up to 9.6.3, 9.5.x up to 9.5.8, and 9.4.x up to 9.4.10. Successful exploitation could give attackers control of the Orchestrator, potentially allowing them to change routing configurations, intercept network traffic or compromise connected SD-WAN Gateways. HPE recommends upgrading to 9.7.1, 9.6.4, 9.5.9 or 9.4.11, depending on the deployment branch, following its official advisory. Where an immediate upgrade is not possible, administrators should restrict web-based management interfaces to dedicated, secured VLANs.