Quick answers
- Is CVE-2026-76674 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-76674 being exploited in the wild.
- How severe is CVE-2026-76674?
- Critical severity, with a CVSS score of 9.8, published 15 September 2026.
- Which products and versions are affected?
- Hpe EdgeConnect SD-WAN Gateway <UNKNOWN>.
- Is there a fix for CVE-2026-76674?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-76674 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-76674?
- Check whether you run Hpe EdgeConnect SD-WAN Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A buffer overflow vulnerability exists in the underlying operating system of HPE EdgeConnect SD-WAN Gateways. The flaw is remotely exploitable without authentication, allowing an attacker to send specially crafted network packets that overflow a buffer and overwrite adjacent memory. Successful exploitation enables arbitrary code execution with the privileges of the vulnerable service, leading to complete system compromise. No authentication is required; the attacker must have network access to the appliance.
Affected products
- HPE EdgeConnect SD-WAN Gateway <UNKNOWN>
Timeline
- 2026-09-15: disclosed
- other: No evidence of active exploitation in the wild