CVE-2026-76680: EdgeConnect SD-WAN Orchestrator SSRF Flaw

CVE-2026-76680 Overview

CVE-2026-76680 is a server-side request forgery (SSRF) vulnerability affecting the API of the HPE Aruba Networking EdgeConnect SD-WAN Orchestrator. A remote attacker authenticated with low-level privileges can abuse the API to force the Orchestrator host to issue attacker-controlled requests. Successful exploitation allows enumeration of the internal structure of the Orchestrator host and disclosure of sensitive information beyond the attacker's authorized privilege level. The scope changes because the vulnerable component impacts resources outside its own security boundary, expanding the blast radius of a single low-privileged account.

Critical Impact
An authenticated low-privileged API user can pivot through the Orchestrator to reach internal network resources and disclose sensitive host and service data.

Affected Products

HPE Aruba Networking EdgeConnect SD-WAN Orchestrator (API component)
Refer to the HPE Security Bulletin for the authoritative list of affected versions
Deployments exposing the Orchestrator API to authenticated users

Discovery Timeline

2026-09-15 - CVE-2026-76680 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76680

Vulnerability Analysis

The flaw resides in one or more API endpoints of the EdgeConnect SD-WAN Orchestrator that accept URL or host parameters and issue outbound requests without adequate validation of the destination. This behavior matches the Server-Side Request Forgery (SSRF) pattern [CWE-918], where a server-side component is coerced into making requests on behalf of an attacker.

Because the Orchestrator operates as a centralized management plane for SD-WAN appliances, the affected API typically has network reachability to internal management interfaces, metadata services, and adjacent infrastructure that external attackers cannot reach directly. An authenticated low-privileged user can weaponize this reachability to probe internal hosts, enumerate open ports, and retrieve responses containing sensitive configuration or service data.

The scope change indicates the impact extends beyond the vulnerable component itself, reaching data owned by other security authorities on the network.

Root Cause

The root cause is insufficient validation and allow-listing of user-supplied destinations passed to server-side HTTP client functions within the Orchestrator API. Requests to internal addresses, loopback interfaces, and non-HTTP schemes are not properly restricted, and response content or metadata is returned to the caller in a form that supports enumeration.

Attack Vector

Exploitation requires network access to the Orchestrator API and valid credentials with low privileges. The attacker submits crafted API requests containing URLs pointing to internal targets. The Orchestrator issues the request from its own network position and reflects observable behavior, such as response bodies, status codes, or timing, back to the attacker. Iterating through internal address ranges and ports yields a map of internal services and, in some cases, sensitive content from those services.

No verified public exploit code is available at the time of publication. Refer to the HPE Security Bulletin for vendor-provided technical detail.

Detection Methods for CVE-2026-76680

Indicators of Compromise

Orchestrator API requests containing URL parameters that reference internal RFC1918 addresses, 127.0.0.1, localhost, or cloud metadata endpoints such as 169.254.169.254.
Outbound HTTP requests from the Orchestrator host to unexpected internal services or non-standard ports.
Repeated API calls from a single low-privileged account that iterate through address ranges or port numbers.
API responses to a low-privileged user containing content sourced from internal-only services.

Detection Strategies

Baseline the Orchestrator's normal outbound request patterns and alert on deviations, especially connections to loopback, link-local, or private ranges initiated by the API process.
Correlate authenticated API session activity with outbound network telemetry from the Orchestrator host to identify request pivoting.
Implement server-side logging of URL parameters submitted to Orchestrator API endpoints and review for suspicious hosts or schemes such as file://, gopher://, or dict://.

Monitoring Recommendations

Forward Orchestrator API access logs and host network telemetry to a centralized analytics platform for correlation.
Monitor authentication logs for low-privileged accounts exhibiting elevated API request volumes.
Alert on any Orchestrator-originated request to cloud instance metadata services.

How to Mitigate CVE-2026-76680

Immediate Actions Required

Apply the vendor-supplied fixed release identified in the HPE Security Bulletin as soon as maintenance windows allow.
Audit Orchestrator user accounts and revoke unnecessary low-privileged API access.
Rotate credentials and API tokens for any account that may have been exposed to untrusted users.

Patch Information

HPE has published remediation guidance and fixed software versions in security bulletin hpesbnw05135en_us. Administrators should consult the bulletin for the specific EdgeConnect SD-WAN Orchestrator releases that address CVE-2026-76680 and follow the documented upgrade path.

Workarounds

Restrict network access to the Orchestrator API using firewall rules or management VLAN segmentation so only trusted administrative networks can reach it.
Enforce egress filtering on the Orchestrator host to block outbound connections to internal management ranges, loopback, and cloud metadata endpoints that the Orchestrator does not legitimately require.
Review role-based access control assignments and remove API entitlements from accounts that do not require them.

bash

# Example egress restriction concept for the Orchestrator host
# Block outbound access to cloud instance metadata service
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Restrict Orchestrator API exposure to a management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP