CVE-2026-76669

This is a permissions problem in the device’s management interface. It is like giving a visitor badgeholder a way to open the building’s master-key cabinet: someone with only basic access could gain control over the whole device.

This matters to you if you run EdgeConnect SD-WAN Gateways and allow staff, contractors, or connected systems to use its management interface. Review every basic account that can reach it remotely. It is only a risk if an attacker already has a valid basic account and remote network access to the interface.

A basic account can be turned into full administrator control, allowing an attacker to read data, change settings, and interrupt operations. No confirmed real-world exploitation has been reported, but the potential for complete device takeover makes this a red-priority issue.

1. Inventory EdgeConnect SD-WAN Gateways deployments and determine which management interfaces are reachable from remote networks.
2. Review accounts with low privileges that can authenticate to the management API; disable unused, shared, former-employee, and unnecessary integration accounts.
3. Limit management-interface access to approved administrator networks and identities, and remove broad remote access while patching is unavailable.
4. No vendor fixed version or supported branch guidance is available in the findings. Obtain the fixed release directly from HPE Networking, confirm its applicability to your deployment, and follow its upgrade guidance when released.
5. If patching is delayed, maintain the access restrictions above and require stronger controls around all remaining low-privileged accounts.
6. There is no CISA KEV due date because this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Monitor administrator-account creation, privilege changes, configuration changes, and unusual management API activity.

CVSS v3.1: 9.9 Critical (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). CWE-269 authorization/privilege-management flaw; network attack vector; exploitation requires a valid low-privileged authenticated account with remote API access and no user interaction. The capability is administrator-level compromise with high confidentiality, integrity, and availability impact. It is not in CISA KEV, no public exploit code is on record, and no clear dated report confirms exploitation in the wild. EPSS is 0.4% (38th percentile) with a flat trend. Press attention is rising due to a roundup, not a confirmed exploitation claim.