External risk intelligence

EdgeConnect SD-WAN Gateway Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-76675

The vulnerability affects SD-WAN Gateways and Orchestrators, which are network infrastructure appliances commonly deployed to manage and provide connectivity across wide area networks. These systems are typically positioned as edge services or management portals, making them reachable via the network to facilitate administrative or gateway functions.

Command Injection

Arubanetworks Edgeconnect Sd Wan Orchestrator

9.4.0 to before 9.4.119.5.0 to before 9.5.99.6.0 to before 9.6.49.7.09.4.0.0 to before 9.4.9.09.5.0.0 to before 9.5.9.09.6.0.0 to before 9.6.4.09.7.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A command injection vulnerability has been identified in the command line interface of Aruba EdgeConnect SD-WAN Gateways. This issue, if exploited by an authenticated remote attacker with high privileges, could allow for the execution of arbitrary commands, potentially leading to a full system compromise. The vulnerability affects network infrastructure used for wide area network management and connectivity.

Command execution vulnerability in network gateways.
Crucial for network infrastructure security and control.
Confirm relevance and exposure for operational integrity.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by first gaining high-privilege authenticated access to the EdgeConnect SD-WAN Gateway's command line interface. From there, they can inject malicious commands, which are then executed by the system, potentially leading to full control over the device.

Entry condition: Authenticated, high-privilege access.
Trigger point: Command line interface execution.
Resulting risk: Arbitrary command execution, system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated attacker with high privileges to execute arbitrary commands on the underlying operating system of EdgeConnect SD-WAN Gateways. This could lead to a complete compromise of the affected system when accessed remotely.

System data could be at risk.
Authenticated high-privilege access could enable exposure.
Complete system compromise is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

The command injection vulnerability in EdgeConnect SD-WAN Gateways affects the underlying operating system, indicating a critical risk for complete system compromise. Responsibility for addressing this likely falls to infrastructure or platform teams managing these network appliances, in coordination with security teams to assess exposure. The first practical step is to identify all deployed gateways and orchestrators, confirm their network reachability and business criticality, and then engage the accountable owner to plan remediation.

Identify appliance owners and deployment scope.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is an EdgeConnect SD-WAN Gateway?

EdgeConnect SD-WAN Gateways and Orchestrators are networking components designed to manage wide area network (WAN) connectivity. They function as central infrastructure hubs that coordinate traffic flow, security, and performance across distributed locations. Because these systems act as the bridge between different network segments, they are vital for maintaining control and consistency in an organization's overall network architecture.

What does command injection mean in CVE-2026-76675?

This vulnerability is classified as CWE-77, or Improper Neutralization of Special Elements used in a Command. In simple terms, the system fails to properly filter instructions provided by a user. An attacker can use this weakness to 'inject' their own malicious commands into the system's interface, tricking the gateway into running unauthorized code as if it were a legitimate administrative task.

How does an attacker trigger this vulnerability?

Exploitation requires two specific conditions: the attacker must already possess high-privilege credentials and must be able to reach the command line interface. Simply being a standard user or an unauthenticated visitor is not sufficient to trigger the flaw. The vulnerability does not allow unauthorized access; rather, it allows a trusted, high-level user to misuse the command interface to run unintended system-level operations.

Is my network device at risk according to Halo Surface Signal?

Halo Surface Signal indicates a 'Likely' risk rating because these appliances are intentionally positioned at the network edge to provide connectivity and management services. Because they are designed to be reachable via the network to perform these functions, they are often exposed to environments where remote access is possible, increasing the importance of ensuring these devices are properly secured.

What is the first step to address CVE-2026-76675?

Start by identifying all EdgeConnect SD-WAN Gateways and Orchestrators deployed in your environment. Once you have a complete inventory, verify which units are reachable over the network and prioritize those with business-critical roles. Finally, coordinate with the infrastructure teams responsible for these appliances to review the vendor's guidance and schedule the necessary updates to eliminate the risk.

References

support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.