news.mlab.sh
Back to the feed
vulnerability

Multiples vulnérabilités dans les produits HPE Aruba Networking (16 septembre 2026)

Sep 16, 2026 · CERT-FR
CriticalCVSS 9.9
Summary

Multiple vulnerabilities have been discovered in HPE Aruba Networking products, including SD-WAN gateways and orchestrator. These vulnerabilities can lead to data integrity compromise, data confidentiality breach, policy circumvention, and denial of service. Exploitation is possible, allowing for remote code execution and privilege escalation. The affected products are versions of EdgeConnect SD-WAN Gateways and EdgeConnect SD-WAN Orchestrator, with versions prior to the specified ECOS and Orchestrator patches.

Multiple vulnerabilities have been discovered in HPE Aruba Networking products, including EdgeConnect SD-WAN Gateways and EdgeConnect SD-WAN Orchestrator. These vulnerabilities can lead to data integrity compromise, data confidentiality breach, policy circumvention, and denial of service. Exploitation is possible, allowing for remote code execution and privilege escalation. The affected products are versions of EdgeConnect SD-WAN Gateways and EdgeConnect SD-WAN Orchestrator, with versions prior to the specified ECOS and Orchestrator patches.

Systems affected include EdgeConnect SD-WAN Gateways versions 9.4.x.x prior to ECOS 9.4.9.0, EdgeConnect SD-WAN Gateways versions 9.5.x.x prior to ECOS 9.5.9.0, EdgeConnect SD-WAN Gateways versions 9.6.x.x prior to ECOS 9.6.4.0, EdgeConnect SD-WAN Gateways versions 9.7.x.x prior to ECOS 9.7.1.0, EdgeConnect SD-WAN Orchestrator versions 9.4.x prior to Orchestrator 9.4.11, EdgeConnect SD-WAN Orchestrator versions 9.5.x prior to Orchestrator 9.5.9, EdgeConnect SD-WAN Orchestrator versions 9.6.x prior to Orchestrator 9.6.4, and EdgeConnect SD-WAN Orchestrator versions 9.7.x prior to Orchestrator 9.7.1.

The vulnerabilities are detailed through a series of CVE identifiers, including CVE-2024-32664, CVE-2026-76669, CVE-2026-76670, CVE-2026-76672, CVE-2026-76673, CVE-2026-76674, CVE-2026-76675, CVE-2026-76676, CVE-2026-76677, CVE-2026-76678, CVE-2026-76679, CVE-2026-76680, CVE-2026-76681, CVE-2026-76682, CVE-2026-76683, CVE-2026-76684, CVE-2026-76685, CVE-2026-76686, CVE-2026-76687, CVE-2026-76688, CVE-2026-76689, CVE-2026-76690, CVE-2026-76691, CVE-2026-76692, CVE-2026-76693, CVE-2026-76694, CVE-2026-76695, CVE-2026-76696, CVE-2026-76697, CVE-2026-76698, CVE-2026-76699, CVE-2026-76700, CVE-2026-76701, CVE-2026-76702, CVE-2026-76703, CVE-2026-76704, CVE-2026-76705, and CVE-2026-76706. The bulletin from HPE Aruba Networking (HPESBNW05135) provides further details and instructions for remediation.

Read the full article at CERT-FR