CVE-2026-76688 is a high-severity vulnerability in the web-based management interface of HPE EdgeConnect SD-WAN Orchestrator. It allows an unauthenticated remote attacker to circumvent authentication controls, potentially gaining administrative privileges and full control over the orchestrator host. The vulnerability affects multiple specific versions of the product, ranging from 9.4.0 up to 9.7.0. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to an unauthenticated attacker gaining administrative privileges on the EdgeConnect SD-WAN Orchestrator host, resulting in complete compromise of the system. This includes full control over the management interface and potentially the underlying infrastructure managed by the orchestrator.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict access to the management interface to trusted networks and monitor for any suspicious activity. Follow vendor guidance once available.