This vulnerability (CVE-2026-76697) exists in the web-based management interface of HPE EdgeConnect SD-WAN Gateways. It permits a remote attacker who has low privilege authenticated access to retrieve sensitive information. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The CVSS v3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The affected versions include 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker with low privilege authenticated access to the web management interface can retrieve sensitive information. This information disclosure could potentially be leveraged to gain further unauthorized access to network services supported by the affected HPE EdgeConnect SD-WAN Gateways. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, it is recommended to monitor HPE advisories for updates. Restrict access to the management interface to trusted users and networks to reduce exposure until a fix is available.