Command Injection Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways
CVE-2026-76698

6.5MEDIUM

Key Information:

Vendor

HP (HP)

Status
Edgeconnect Sd-wan Gateways
Vendor
CVE Published:
15 September 2026

What is CVE-2026-76698?

A command injection flaw exists within the web management interface of HPE Networking EdgeConnect SD-WAN Gateways. This vulnerability allows an authenticated remote attacker, with limited access roles, to exploit the system through specially crafted input. If successfully exploited, it could lead to the execution of arbitrary commands, potentially granting elevated privileges or resulting in a denial-of-service condition on the affected device.

Affected Version(s)

EdgeConnect SD-WAN Gateways 9.7.0.0

EdgeConnect SD-WAN Gateways 9.7.0.0

EdgeConnect SD-WAN Gateways 9.6.0.0 <= 9.6.3.1

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Internal security research (HPE Networking).
.