External risk intelligence

HPE EdgeConnect SD-WAN Gateways OS Buffer Overflow Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-76674

The affected products are HPE Networking EdgeConnect SD-WAN Gateways and Orchestrators, which are network edge devices designed to be deployed at the internet perimeter to manage traffic and secure wide area network connections. By their product role, these devices are public-facing or sit at the immediate edge of the network, making them highly accessible from the internet.

Buffer Overflow

Arubanetworks Edgeconnect Sd Wan Orchestrator

9.4.0 to before 9.4.119.5.0 to before 9.5.99.6.0 to before 9.6.49.7.09.4.0.0 to before 9.4.9.09.5.0.0 to before 9.5.9.09.6.0.0 to before 9.6.4.09.7.0.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Buffer overflow vulnerabilities have been identified in the operating system of HPE Networking EdgeConnect SD-WAN Gateways. If exploited, these could allow an attacker to execute arbitrary code and gain complete control of the system.

Unauthenticated attackers can gain full system control.
Affects critical network edge devices.
Confirm relevance and exposure for business continuity.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can reach the vulnerable component over the network. By sending specially crafted data, the attacker can trigger a buffer overflow in the operating system. This could allow the attacker to execute arbitrary code and gain full control of the system.

Entry: Network access.
Trigger: Specially crafted data.
Risk: Complete system compromise.

Live Threat

Current exploitation, exposure, and threat context

Buffer overflow vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to execute arbitrary code. When exploited, this could lead to an attacker executing arbitrary commands on the underlying operating system, resulting in complete system compromise.

System data and integrity at risk.
Unauthenticated remote code execution.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects HPE Networking EdgeConnect SD-WAN Gateways, indicating that platform or infrastructure teams responsible for network edge devices should lead the response. The first practical step is to identify all deployed gateways, confirm their exposure to external networks, and determine business criticality to prioritize remediation.

Network platform teams own this issue.
Verify external gateway exposure and criticality.
Plan vendor-coordinated upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the HPE EdgeConnect SD-WAN Gateway?

These gateways are networking devices used to manage traffic across wide area networks. They act as the foundation for SD-WAN deployments, handling connectivity, security, and traffic optimization. The affected software component is the underlying operating system that powers these gateways and the associated Orchestrator, which acts as the management platform for these dispersed network edge devices.

What does CWE-120 mean for CVE-2026-76674?

CVE-2026-76674 involves a buffer overflow, categorized as CWE-120. In plain terms, this means the software does not properly check the amount of data being copied into a reserved memory space. If an attacker sends more data than the system expects, that extra data can overwrite adjacent memory. This weakness allows an attacker to inject and execute their own unauthorized code on the device.

How is this buffer overflow triggered?

An unauthenticated remote attacker triggers this vulnerability by sending specially crafted data packets to the gateway over the network. This process relies on direct interaction with the system's communication interfaces. Importantly, this bug is not triggered by standard, legitimate network traffic or normal administrative management commands; it requires data specifically designed to exceed memory boundaries.

Why is this CVE relevant to my network?

According to Halo Surface Signal, these devices are designed to sit at the internet perimeter to manage wide area connections. Because they are intended to be public-facing or at the immediate edge, they are highly accessible to internet-based threats. Even if the device is not directly on the open internet, it remains a critical point of failure for network security and traffic control.

Do I need to update my HPE EdgeConnect software?

Yes. If you operate these gateways, your first step is to inventory your devices and confirm their current software version. Because this is a critical remote code execution vulnerability, prioritize verifying if your gateways are reachable from external networks. Coordinate with your network platform teams to plan and apply the vendor-provided security upgrades as soon as possible.

References

support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.