Security Resilience

CVE-2026-76675

RCE in Hpe Edgeconnect Operating System 9.4.0.0 – 9.4.9.0

RCECommand Injection
Published
15 September 2026
Modified
28 September 2026
Patch / advisory
View advisory
CVSS Score v3.1 9.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.015 73th percentile
Risk Priority 61 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS scores by FIRST (EPSS SIG), generated by Empirical Security. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-76675 is a critical-severity Command Injection (CWE-77) vulnerability in Hpe Edgeconnect Operating System. Its CVSS base score is 9.1 (Critical).

Operationally, ranked in the top 27% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability Data

A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to execute arbitrary commands on the underlying operating system leading to complete system compromise.

CWE(s)
CWE-77

Related Threats

CVEs Like This One

CVE-2026-76679Same product: Arubanetworks Edgeconnect Sd-Wan Orchestrator
CVE-2026-76690Same product: Arubanetworks Edgeconnect Sd-Wan Orchestrator
CVE-2026-76689Same product: Arubanetworks Edgeconnect Sd-Wan Orchestrator
CVE-2026-76683Same product: Arubanetworks Edgeconnect Sd-Wan Orchestrator
CVE-2026-76673Same product: Arubanetworks Edgeconnect Sd-Wan Orchestrator
CVE-2026-76674Same product: Arubanetworks Edgeconnect Sd-Wan Orchestrator
CVE-2026-76678Same product: Arubanetworks Edgeconnect Sd-Wan Orchestrator
CVE-2026-76670Same product: Arubanetworks Edgeconnect Sd-Wan Orchestrator
CVE-2026-76672Same product: Arubanetworks Edgeconnect Sd-Wan Orchestrator
CVE-2026-76669Same product: Arubanetworks Edgeconnect Sd-Wan Orchestrator

Affected Assets

arubanetworks
edgeconnect sd-wan orchestrator
9.7.0 · 9.4.0 — 9.4.11 · 9.5.0 — 9.5.9 · 9.6.0 — 9.6.4
hpe
edgeconnect operating system
9.7.0.0 · 9.4.0.0 — 9.4.9.0 · 9.5.0.0 — 9.5.9.0 · 9.6.0.0 — 9.6.4.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation partial match

Developer testing and evaluation can discover command-construction flaws before deployment.

SA-8 Security and Privacy Engineering Principles partial match

Secure engineering principles include proper neutralization and safe command construction practices.

SI-10 Information Input Validation partial match

Input validation directly stops construction of commands from untrusted data containing special elements.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development catches command-injection vulnerabilities before release.

A.8.28 Secure coding partial match
prevents

Secure coding standards require proper escaping and parameterization of commands, directly eliminating CWE-77.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-77, a class-level weakness, and none of its children carries one either.

References