CVE-2026-76681: EdgeConnect SD-WAN Information Disclosure

CVE-2026-76681 Overview

CVE-2026-76681 is an authorization flaw in the API of HPE Aruba Networking EdgeConnect SD-WAN Orchestrator. An authenticated attacker holding a low-privilege account can query API endpoints and retrieve sensitive information beyond the scope of their assigned role. The exposed data can be leveraged to gain further access to network services managed through the Orchestrator.

The vulnerability affects centralized SD-WAN management, giving it broad impact across distributed branch networks that rely on Orchestrator for policy, tunnel, and appliance control.

Critical Impact
A low-privileged authenticated user can extract information across privilege boundaries, enabling reconnaissance and lateral access to network services managed by EdgeConnect SD-WAN Orchestrator.

Affected Products

HPE Aruba Networking EdgeConnect SD-WAN Orchestrator
Refer to the HPE Security Bulletin for the exact affected releases
Downstream managed EdgeConnect appliances whose configuration data is exposed via Orchestrator

Discovery Timeline

2026-09-15 - CVE-2026-76681 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76681

Vulnerability Analysis

The flaw is a broken access control weakness in Orchestrator's REST API. API handlers authenticate the caller but do not consistently enforce role-based authorization on the data returned. Requests issued by a low-privileged user succeed against endpoints that should be restricted to higher-privileged administrators.

Because the scope is changed (the disclosed data crosses the security boundary of the caller's role), a single low-privileged account becomes a reconnaissance foothold. Attackers can enumerate tunnel configurations, credentials, appliance inventories, and topology data to plan follow-on activity against managed network services.

Root Cause

The root cause is missing or inconsistent authorization checks on API endpoints. The API validates that the caller is authenticated but does not verify whether the caller's role is permitted to read the requested resource. This is a classic Broken Access Control pattern where authentication is treated as sufficient for authorization.

Attack Vector

Exploitation requires network access to the Orchestrator API and valid credentials for a low-privileged account. No user interaction is needed. An attacker sends crafted API requests to endpoints exposing configuration, credential, or inventory data. See the HPE Security Bulletin for technical specifics on affected endpoints.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.293%.

Detection Methods for CVE-2026-76681

Indicators of Compromise

Low-privileged Orchestrator accounts issuing API requests to endpoints normally accessed only by administrators
Unusual volumes of GET requests against configuration, inventory, or credential-related API paths from a single session
API access from geographies or source IP ranges that do not match the operator's baseline
Sequential enumeration of appliance IDs, tunnel IDs, or user objects within a short window

Detection Strategies

Enable and centralize Orchestrator API access logging, including caller identity, endpoint, HTTP status, and response size
Baseline API usage per role and alert on deviations, especially read operations that exceed the role's normal working set
Correlate Orchestrator authentication events with subsequent API activity to identify accounts pivoting outside their scope
Ingest Orchestrator logs into a SIEM or data lake for cross-source correlation with network and identity telemetry

Monitoring Recommendations

Monitor for privilege-mismatch patterns: low-role accounts hitting endpoints associated with high-privilege operations
Track credential and configuration export endpoints for any access outside change windows
Alert on repeated 403 responses followed by successful 200 responses from the same account, which can indicate probing
Review low-privilege account creation and role assignments on Orchestrator regularly

How to Mitigate CVE-2026-76681

Immediate Actions Required

Apply the fixed Orchestrator release documented in the HPE Security Bulletin as soon as possible
Audit all Orchestrator user accounts and remove or disable unused low-privilege accounts
Rotate credentials, API tokens, and shared secrets that may have been exposed via the API before patching
Restrict management-plane network access so only trusted administrative networks can reach the Orchestrator API

Patch Information

HPE has published fixed versions in security bulletin hpesbnw05135en_us. Administrators should consult the HPE Security Bulletin to identify the specific fixed release for their deployed Orchestrator version and follow HPE's upgrade procedure.

Workarounds

Place the Orchestrator management interface behind a VPN or jump host to limit exposure to authenticated internal users only
Enforce strict least-privilege on Orchestrator roles and remove permissions not required for day-to-day operation
Require multi-factor authentication for all Orchestrator accounts to raise the cost of credential compromise
Increase log retention and monitoring on Orchestrator until the patch is applied

bash

# Configuration example: restrict Orchestrator API exposure at the network edge
# Replace <mgmt_cidr> with your administrative network and <orch_ip> with the Orchestrator address
iptables -A INPUT -p tcp -s <mgmt_cidr> -d <orch_ip> --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -d <orch_ip> --dport 443 -j DROP