Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-76704

EdgeConnect SD-WAN Gateways · cross-site scripting

CVSS 3.1 5.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-76704

Published

A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Successful exploitation could allow an attacker to access sensitive information, potentially affecting the confidentiality and integrity of the data processed by the application.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-76704

Published

EdgeConnect SD-WAN Gateways

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "affected",
                    "product": "EdgeConnect SD-WAN Gateways",
                    "vendor": "Hewlett Packard Enterprise (HPE)",
                    "versions": [
                        {
                            "lessThanOrEqual": "9.7.0",
                            "status": "affected",
                            "version": "9.7.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThanOrEqual": "9.6.3",
                            "status": "affected",
                            "version": "9.6.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThanOrEqual": "9.5.8",
                            "status": "affected",
                            "version": "9.5.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThanOrEqual": "9.4.10",
                            "status": "affected",
                            "version": "9.4.0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON