Authenticated Path Traversal allows Unauthorized Access in Web Interface

published 2026-07-21 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-46416

cvss: 7.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits: 0; none known

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 3 mo ago (2026-07-23)

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateway (ECOS)

Classification

Weakness

CWE-377 DEPRECATED: Insecure Temporary File
CWE-732 Incorrect Permission Assignment for Critical Resource

References

support.hpe.com /hpesc/public/docDisplay?docId=hpesbnw05013en_us&docLocale=en_US

Sources

CVE List CVE-2026-44878
NVD CVE-2026-44878

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary