# HPE Aruba EdgeConnect multiple vulnerabilities disclosed

Published: 2026-09-16 · Severity: elevated · Sectors: infrastructure, telecommunications
Canonical: https://vorant.io/reports/c84104e4-e230-5144-a845-93bd0129cc0f/hpe-aruba-edgeconnect-multiple-vulnerabilities-disclosed

> Multiple vulnerabilities in HPE Aruba EdgeConnect SD-WAN products allow remote code execution, privilege escalation, and denial of service.

CERT-FR published a security advisory documenting multiple vulnerabilities affecting HPE Aruba Networking products, specifically EdgeConnect SD-WAN Gateways and Orchestrator components. The vulnerabilities span versions 9.4.x through 9.7.x and enable attackers to achieve remote code execution, privilege escalation, data confidentiality and integrity breaches, security policy bypass, remote denial of service, and server-side request forgery (SSRF). Affected versions include EdgeConnect SD-WAN Gateways 9.4.x before ECOS 9.4.9.0, 9.5.x before 9.5.9.0, 9.6.x before 9.6.4.0, and 9.7.x before 9.7.1.0, as well as corresponding Orchestrator versions. Defenders operating these SD-WAN gateway and orchestrator products should prioritize patching to the fixed versions identified in HPE's security bulletin HPESBNW05135, released 15 September 2026.

## Mentioned in this report

- Vulnerabilities: CVE-2024-32664, CVE-2026-76669, CVE-2026-76670, CVE-2026-76672, CVE-2026-76673, CVE-2026-76674, CVE-2026-76675, CVE-2026-76676, CVE-2026-76677, CVE-2026-76678, CVE-2026-76679, CVE-2026-76680, CVE-2026-76681, CVE-2026-76682, CVE-2026-76683, CVE-2026-76684, CVE-2026-76685, CVE-2026-76686, CVE-2026-76687, CVE-2026-76688, CVE-2026-76689, CVE-2026-76690, CVE-2026-76691, CVE-2026-76692, CVE-2026-76693, CVE-2026-76694, CVE-2026-76695, CVE-2026-76696, CVE-2026-76697, CVE-2026-76698, CVE-2026-76699, CVE-2026-76700, CVE-2026-76701, CVE-2026-76702, CVE-2026-76703, CVE-2026-76704, CVE-2026-76705, CVE-2026-76706, CVE-2026-76707

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1179

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c84104e4-e230-5144-a845-93bd0129cc0f/hpe-aruba-edgeconnect-multiple-vulnerabilities-disclosed.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup