CVE-2026-44878

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44878", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2026-05-07T21:29:22.243Z", "datePublished": "2026-07-21T20:42:17.908Z", "dateUpdated": "2026-07-23T13:29:55.282Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2026-07-21T20:42:17.908Z"}, "title": "Authenticated Path Traversal allows Unauthorized Access in Web Interface", "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "EdgeConnect SD-WAN Gateway (ECOS)", "versions": [{"status": "affected", "version": "9.4.0.0", "lessThanOrEqual": "9.4.6.0", "versionType": "semver"}, {"status": "affected", "version": "9.5.0.0", "lessThanOrEqual": "9.5.6.0", "versionType": "semver"}, {"status": "affected", "version": "9.6.0.0", "lessThanOrEqual": "9.6.1.0", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data.</p>"}]}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05013en_us&docLocale=en_US"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "moonv", "type": "reporter"}], "source": {"advisory": "HPESBNW05013", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-377", "lang": "en", "description": "CWE-377 Insecure Temporary File"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-732", "lang": "en", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T13:29:12.335150Z", "id": "CVE-2026-44878", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T13:29:55.282Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44878", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-23T13:29:12.335150Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-377", "description": "CWE-377 Insecure Temporary File"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T13:28:05.526Z"}}], "cna": {"title": "Authenticated Path Traversal allows Unauthorized Access in Web Interface", "source": {"advisory": "HPESBNW05013", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "moonv"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "EdgeConnect SD-WAN Gateway (ECOS)", "versions": [{"status": "affected", "version": "9.4.0.0", "versionType": "semver", "lessThanOrEqual": "9.4.6.0"}, {"status": "affected", "version": "9.5.0.0", "versionType": "semver", "lessThanOrEqual": "9.5.6.0"}, {"status": "affected", "version": "9.6.0.0", "versionType": "semver", "lessThanOrEqual": "9.6.1.0"}], "defaultStatus": "affected"}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05013en_us&docLocale=en_US"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data.", "supportingMedia": [{"type": "text/html", "value": "<p>A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data.</p>", "base64": false}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2026-07-21T20:42:17.908Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44878", "state": "PUBLISHED", "dateUpdated": "2026-07-23T13:29:55.282Z", "dateReserved": "2026-05-07T21:29:22.243Z", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "datePublished": "2026-07-21T20:42:17.908Z", "assignerShortName": "hpe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "EdgeConnect SD-WAN Gateway (ECOS)", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"lessThanOrEqual": "9.4.6.0", "status": "affected", "version": "9.4.0.0", "versionType": "semver"}, {"lessThanOrEqual": "9.5.6.0", "status": "affected", "version": "9.5.0.0", "versionType": "semver"}, {"lessThanOrEqual": "9.6.1.0", "status": "affected", "version": "9.6.0.0", "versionType": "semver"}]}], "source": "security-alert@hpe.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de gesti\u00f3n basada en web de un dispositivo ECOS podr\u00eda permitir a un atacante remoto autenticado y con altos privilegios acceder al sistema de archivos del dispositivo. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda permitir a un atacante acceder a archivos sensibles y manipular o eliminar datos del sistema."}], "id": "CVE-2026-44878", "lastModified": "2026-10-24T19:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security-alert@hpe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44878", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-23T13:29:12.335150Z", "version": "2.0.3"}}]}, "published": "2026-07-21T21:16:49.640", "references": [{"source": "security-alert@hpe.com", "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05013en_us&docLocale=en_US"}], "sourceIdentifier": "security-alert@hpe.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-377"}, {"lang": "en", "value": "CWE-732"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[9.4.0.0,9.4.6.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[9.5.0.0,9.5.6.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[9.6.0.0,9.6.1.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "EdgeConnect SD-WAN Gateway (ECOS)", "source": "cna", "vendor": "Hewlett Packard Enterprise (HPE)"}, "product": "edgeconnect_sd-wan_gateway", "vendor": "hpe"}], "created": "2026-07-23T21:12:38.093559+00:00", "updated": "2026-08-04T18:00:14.123585+00:00", "vendors": ["hpe", "hpe$PRODUCT$edgeconnect_sd-wan_gateway"]}