Skip to content
VulniPulse
Sign in
Advisory severityCritical9.9HPE Aruba Networking

Critical [CVE-2026-76672] Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator

This critical-severity HPE Aruba Networking advisory covers CVE-2026-76672 affecting EdgeConnect SD-WAN Gateways.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-76672 Source published Source updated

VulniPulse record published

CVE-2026-76672
Affected products & platforms
HPE Aruba NetworkingEdgeConnect SD-WAN
Open source advisory

Android app · Google Play

Monitor future HPE Aruba Networking CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint.

Successful exploitation could result in the disclosure of sensitive third-party API tokens and credentials, potentially enabling lateral movement to external security platforms.

Affected product named by the advisory: EdgeConnect SD-WAN Gateways.

Affected versions
  • EdgeConnect SD-WAN Gateways through 9.7.0
  • EdgeConnect SD-WAN Gateways 9.6.0 through 9.6.3
  • EdgeConnect SD-WAN Gateways 9.5.0 through 9.5.8
  • EdgeConnect SD-WAN Gateways 9.4.0 through 9.4.10

Official advisory · high-confidence parse· fetched 21 days ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

Official advisory · high-confidence parse· fetched 21 days ago·verify at source

Mitigation

The source record does not include mitigation steps. That is not a statement that no fix exists — read the vendor advisory below for the authoritative guidance.

Official advisory · high-confidence parse· fetched 21 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.