CVE-2026-76672

A user with a basic account may be able to uncover secret keys that the system stores for connecting to other security services. It is like giving someone permission to view a building directory but accidentally also letting them copy the master keys kept behind the front desk.

This matters to you if you use or run EdgeConnect SD-WAN Gateways, particularly if it stores credentials for other security tools. It is only a risk when an attacker has valid read-only credentials and can reach the management system over the network.

An attacker with a basic account can extract credentials used to access connected security tools, which can open a path beyond the SD-WAN system itself. Treat this as urgent because the flaw is easy to trigger remotely once such an account is available, even though no confirmed real-world exploitation has been reported.

Confirm exposure by inventorying EdgeConnect SD-WAN Gateways management systems, reviewing read-only accounts, and determining which third-party API tokens or credentials are stored in their configuration. No vendor fixed version or supported-version branch guidance is available at this time; obtain the remediation release and upgrade instructions directly from HPE before making version changes.

Until a patch is available, restrict management access to dedicated administrator networks, remove unnecessary read-only accounts, and rotate API tokens or credentials that may be accessible through the management system. Review logs for unusual requests to the cache synchronization endpoint and for unexpected use of connected third-party service credentials. CISA has not assigned a due date because this CVE is not listed in the Known Exploited Vulnerabilities catalog.

CVSS v3.1 is 9.9 (Critical): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. The issue is CWE-200 sensitive information disclosure, reachable over the network by an authenticated attacker with low/read-only privileges and no user interaction, reportedly involving crafted requests to the cache synchronization endpoint. The disclosed data may include third-party API tokens and credentials. It is not in CISA KEV, no dated press claim confirms exploitation, and no public exploit code is recorded. EPSS is 0.4% (33rd percentile) with a flat trend. No patch information is available.