CVE WatchSep 28, 2026

CVE-2026-76698

A command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticat

CVSS

6.5

Medium

EPSS

4.5%

p92

KEV

—

Exploit Today

0-100

Published: Sep 15, 2026 · Last modified: Sep 28, 2026 · CWE-77

EPSS · 30d

4.5%EPSS · 30 days4.5%

2026-10-172026-11-13

Technical description

A command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker with limited access privileges could exploit this vulnerability through specially crafted input. Successful exploitation, under certain conditions, could result in the execution of arbitrary commands with elevated privileges or a denial-of-service condition on the affected appliance.

Official references

support.hpe.comhttps://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1261677.2 HIG

74.9%

——22A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface.1d CVE-2026-960537.8 HIG

54.7%

——16Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.4d CVE-2026-839535.5 MED

58.1%

——17Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.4d CVE-2026-1233878.0 HIG

57.4%

——17Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.4d CVE-2026-1216628.6 HIG

45.2%

——14Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.5d CVE-2026-1199898.2 HIG

48.9%

——15Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.5d