Vulnerabilities
HPE Aruba SD‑WAN Products Hit by Multiple Remote Code Execution and Privilege‑Escalation Flaws
HPE Aruba Networking has disclosed a set of critical flaws in its EdgeConnect SD‑WAN Gateways and Orchestrator that can be exploited for remote code execution, privilege escalation, and denial‑of‑service. Affected releases include Gateway 9.4.x‑9.7.x (pre‑9.4.9.0, 9.5.9.0, 9.6.4.0, 9.7.1.0) and Orchestrator 9.4.x‑9.7.x (pre‑9.4.11, 9.5.9, 9.6.4, 9.7.1.0). The CVE list ranges from CVE‑2024‑32664 to CVE‑2026‑76696. Patch the firmware immediately and follow HPE’s advisory for configuration hardening.
Overview
HPE Aruba Networking has identified a cluster of vulnerabilities that can be leveraged by an attacker to execute arbitrary code remotely, elevate privileges, and crash the system. The flaws also enable Server‑Side Request Forgery (SSRF) attacks, allowing malicious actors to probe internal networks.
Affected Products
- EdgeConnect SD‑WAN Gateways – versions 9.4.x.x (prior to 9.4.9.0), 9.5.x.x (prior to 9.5.9.0), 9.6.x.x (prior to 9.6.4.0), 9.7.x.x (prior to 9.7.1.0)
- EdgeConnect SD‑WAN Orchestrator – versions 9.4.x (prior to 9.4.11), 9.5.x (prior to 9.5.9), 9.6.x (prior to 9.6.4), 9.7.x (prior to 9.7.1.0)
Impact
- Remote code execution (RCE) – full control over the device
- Privilege escalation – gain root/administrator access
- Denial of service (DoS) – disrupt SD‑WAN connectivity
- SSRF – internal network reconnaissance and potential lateral movement
Mitigation
- Apply the latest firmware or security patches released in HPE Aruba Security Bulletin HPESBNW05135 (15 September 2026).
- Validate all external input and disable unused services on the gateway and orchestrator.
- Configure strict access controls and network segmentation to limit exposure.
- Monitor logs for anomalous API calls or unexpected traffic patterns.
Key CVE Identifiers
- CVE‑2024‑32664
- CVE‑2026‑76669 through CVE‑2026‑76696 (inclusive)
Immediate patching is essential. Contact your HPE Aruba support representative if you are unsure whether your devices are affected or if you need assistance applying the updates.
Related vulnerabilities
Multiple Roundcube Flaws Expose Webmail Servers to RCE, SSRF, and Privilege Escalation
Roundcube Webmail has released critical updates patching several security vulnerabilities affecting 1.6.x and 1.7.x release lines. The flaws expose systems to remote code execution, server-side request forgery, privilege escalation, and cross-site scripting. Administrators are urged to update to Roundcube versions 1.6.18 or 1.7.3 immediately.
Read briefing
Ivanti Connect Secure & Policy Secure Gateways Hit by Multi‑Vulnerability Surge – Patch Now
A wave of critical flaws—CVE‑2024‑22024, CVE‑2024‑21888, CVE‑2024‑21893, CVE‑2023‑46805, CVE‑2024‑21887—has been actively exploited against Ivanti Connect Secure and Policy Secure Gateways. The bugs enable unauthenticated privilege escalation, SSRF, and remote code execution, letting attackers hijack devices and steal credentials. Ivanti released patches for most affected versions in February, with additional fixes rolled out through March. Immediate patching, re‑authentication, and hardened configuration are essential to stop attackers from leveraging these weaknesses.
Read briefing
Fortinet Issues Mass Security Fixes for RCE and Privilege Escalation Vulnerabilities
Fortinet has released updates resolving multiple security vulnerabilities across its product portfolio, including FortiOS, FortiManager, and FortiAnalyzer. Successful exploitation could allow remote code execution, privilege escalation, and denial-of-service attacks. Network administrators should patch affected installations promptly.
Read briefing
Oracle Database Server Hit by Multi‑Vulnerability Storm: Remote Code Execution & DoS
A wave of critical flaws in Oracle Database Server—spanning 19.3 through 23.26.3—enables attackers to launch remote code execution and denial‑of‑service attacks. The vulnerabilities, catalogued under CVE‑2026‑83088 to CVE‑2026‑83351, affect all major releases from 19.3 to 23.26.3. Oracle has released patches in the 15 September 2026 security bulletin. Immediate patching is mandatory for any exposed database instances. CERT‑FR has issued an alert urging rapid remediation.
Read briefing