Authentication Bypass in HPE Networking SD-WAN Orchestrator
CVE-2026-63455

9.8CRITICAL

Key Information:

Vendor

HP (HP)

Status
Edgeconnect Sd-wan Orchestrator
Vendor
CVE Published:
4 August 2026

What is CVE-2026-63455?

Multiple vulnerabilities affecting the REST API of HPE Networking SD-WAN Orchestrator may enable unauthenticated remote attackers to bypass web authentication mechanisms, thereby gaining unauthorized access to system functionalities. Exploiting these vulnerabilities could allow attackers to view and potentially alter sensitive information on the system, representing a significant security risk.

Affected Version(s)

EdgeConnect SD-WAN Orchestrator 9.6.2.00000 <= 9.6.2.40208

EdgeConnect SD-WAN Orchestrator 9.6.3.00000 <= 9.6.3.40137

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was discovered and reported by Christopher Alejandro (Moroco) through HPE Aruba Networking's Bug Bounty program
.