CVE-2026-76670
CRITICAL · 9.9Fresh advisory but no KEV, PoC, or urgent vendor patching signal yet; early noise.
What: Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator API allowing authenticated low-privileged users to gain admin access; CVSS 9.9 CRITICAL.
Why it matters: Published 15 Sept 2026 with maximum severity rating. No KEV listing yet, no public PoC confirmed in posts, no vendor advisory timestamp provided in metadata. Social chatter is early-stage alert recycling without exploitation signal or patch guidance.
Where it's seen: Initial Bluesky posts amplifying NVD description; generic "patch now" messaging; no defender triage questions, no PoC links, no HPE advisory linked.
RISK: CRITICAL — CVSS 9.9 + authenticated escalation to admin in widely-deployed SD-WAN orchestrator.
Description
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High