CVE-2026-76673

The device's management interface may fail to check whether a person is allowed in before granting administrator access. It is like a locked control room whose door can be opened without a key, letting an intruder change the controls for your business network.

This matters to you if you use or run EdgeConnect SD-WAN Gateways. It is a risk only when an unauthenticated attacker can reach the management API remotely.

Treat this as urgent because a reachable attacker can gain full administrator control without first signing in. Restrict access to the management API now while awaiting vendor fix information; no confirmed real-world exploitation has been reported.

Confirm exposure by identifying every EdgeConnect SD-WAN Gateways deployment and determining whether its management API accepts connections from the internet or other untrusted networks. No fixed version or supported upgrade path has been published in the available findings, so obtain the vendor's advisory and target version before making changes.

If patching is delayed, place the API behind a VPN or management network and allow access only from approved administrator systems; remove any public or broadly reachable API access. CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date. Review API access records, administrator accounts, and configuration changes for unauthorized activity, and preserve relevant logs for investigation.

CVSS v3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue is CWE-287, improper authentication, in the EdgeConnect SD-WAN Orchestrator API. An unauthenticated remote attacker with network access to the API can bypass authentication and obtain administrative privileges, resulting in complete host compromise. It is not listed in CISA KEV, no clear dated in-the-wild exploitation claim is available, and no public exploit code is on record. EPSS is 0.5% (39th percentile) with a flat trend; this is a prediction, not evidence of exploitation.