CVE-2026-76674

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways

No known exploitation. EPSS puts it in the 62nd percentile. No fix published yet.

CVSS 3.19.8Critical EPSS percentile62nd1.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-15Updated 2026-09-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Identify every EdgeConnect SD-WAN Gateway your business operates and confirm whether it is reachable from untrusted networks.
Ask HPE or your managed network provider whether your deployed gateway version is affected; no fixed version has been published in the available findings.
Until HPE provides a fix, restrict inbound network access to each gateway to only trusted management networks and necessary business connections.
Review gateway and network logs for unexpected connections, configuration changes, or command activity, and investigate anything unusual.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to execute arbitrary code. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

In plain language

Written by AI from the record

A critical flaw in EdgeConnect SD-WAN Gateways can let a remote outsider take complete control of a device, so small businesses using them should act urgently.

Unauthenticated network-reachable remote code execution in EdgeConnect SD-WAN Gateways due to a CWE-120 buffer overflow in the underlying operating system, enabling full system compromise.

If you're affected

Complete gateway takeover
Network traffic interception
Business connectivity disruption
Customer data exposure
Ransomware staging point

What is it

This is a defect that can cause a gateway to mishandle specially crafted network traffic. It is like an intruder finding a way to turn a building's front-door intercom into the master key for the whole building.

Who is affected

This matters to you if your business runs EdgeConnect SD-WAN Gateways, including devices managed by an IT provider. The available information does not confirm whether the vulnerable service is exposed in the default setup, so prioritize gateways reachable from untrusted networks.

How urgent is it

This is urgent because a successful network attack can give an attacker complete control of the gateway. There is no confirmed public exploitation or public exploit code in the available findings, but the severity and no-account attack path warrant immediate exposure reduction and vendor follow-up.

What to do — in detail

Confirm exposure by inventorying all EdgeConnect SD-WAN Gateways, recording their installed software versions, and determining which network interfaces accept traffic from untrusted networks. Check HPE support advisories or open a support case to establish whether each installed version is affected; the available findings provide no fixed version or supported release branch target.

No upgrade path or compatibility guidance is currently available. If patching is delayed, restrict inbound connectivity to trusted source networks and required business peers only, avoid exposing gateway management or unnecessary services to the internet, and have the device managed by the responsible network team.

CISA has not added CVE-2026-76674 to the Known Exploited Vulnerabilities catalog, so no CISA remediation due date is available. Monitor gateway and perimeter-network logs for unexpected inbound sessions, configuration changes, unusual command activity, and unexplained connectivity changes; preserve relevant logs and isolate affected devices if compromise is suspected.

Technical context

CVE-2026-76674 is rated CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is a CWE-120 buffer overflow in the underlying operating system of EdgeConnect SD-WAN Gateways, reachable through network traffic and requiring neither authentication nor user interaction; successful exploitation permits arbitrary command execution and complete system compromise. CISA KEV does not list this CVE, no public exploit code is on record, and no clear dated reporting confirms exploitation in the wild. EPSS estimates a 1.1% likelihood (62nd percentile), with a flat trend; this is predictive rather than evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS62nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.0% chance of exploitation activity in the next 30 days, which ranks it in the 62nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 6 days, from the signal feeds we watch.

2026-09-21Record updated
2026-09-18OpenVAS check added
2026-09-16Record updated
2026-09-15Publishedweakness classified, att&ck mapped, record updated

Affected products

Hewlett Packard Enterprise (HPE)commercial · USaka hewlett packard enterprise
- EdgeConnect SD-WAN GatewaysMixedHardware Firmware / network-adapter

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable