CVSS 9.9 (critical) · published 2026-09-15
A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint. Successful exploitation could result in the disclosure of sensitive third-party API tokens and credentials, potentially enabling lateral movement to external security platforms.
Affected products (NVD): arubanetworks edgeconnect_sd-wan_orchestrator, hpe edgeconnect_operating_system
Fixed in (NVD): 9.4.11, 9.5.9, 9.6.4, 9.4.9.0, 9.5.9.0, 9.6.4.0
Weakness: CWE-200
Source: NVD CVE-2026-76672
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.