← Back

CVE-2026-76704

nvd nist
Published: Sep 15, 2026Modified: Sep 25, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Exploitability: 2.3 / Impact: 2.7
Source: security-alert@hpe.com (Secondary)

Description

A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Successful exploitation could allow an attacker to access sensitive information, potentially affecting the confidentiality and integrity of the data processed by the application.

Affected (8)

Arubanetworks
1 product
Edgeconnect Sd Wan Orchestrator
Hpe
1 product
Edgeconnect Operating System
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Arubanetworks
Edgeconnect Sd Wan Orchestrator
9.4.0 ≤ version < 9.4.11
Edgeconnect Sd Wan Orchestrator
9.5.0 ≤ version < 9.5.9
Edgeconnect Sd Wan Orchestrator
9.6.0 ≤ version < 9.6.4
Edgeconnect Sd Wan Orchestrator
Version 9.7.0
Configuration B
4 vulnerable
Vulnerable SoftwareAffected Versions
Hpe
Edgeconnect Operating System
9.4.0.0 ≤ version < 9.4.9.0
Edgeconnect Operating System
9.5.0.0 ≤ version < 9.5.9.0
Edgeconnect Operating System
9.6.0.0 ≤ version < 9.6.4.0
Edgeconnect Operating System
Version 9.7.0.0

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

Source: security-alert@hpe.com
Vendor Advisory

Timeline

No history available yet.