Description
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
Published: 2026-08-04
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Multiple vulnerabilities in the REST API of Hewlett Packard Enterprise EdgeConnect SD‑WAN Orchestrator enable an unauthenticated attacker to bypass web authentication mechanisms and manipulate system functions. The flaw is an authentication bypass (CWE‑306), allowing the attacker to view and modify potentially sensitive information without valid credentials.

Affected Systems

Hewlett Packard Enterprise EdgeConnect SD‑WAN Orchestrator across all releases. Because no specific version range is disclosed, every deployment of this product is considered at risk.

Risk and Exploitability

The CVSS score of 9.8 indicates a high‑severity flaw. Exploitation can be achieved remotely by sending crafted HTTP requests to the REST API endpoint, requiring no user interaction. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, its unauthenticated and remote nature poses a significant risk. The likely attack vector, inferred from the description, involves spoofing HTTP headers to subvert authentication checks and gain access to privileged API operations.

Generated by OpenCVE AI on August 4, 2026 at 19:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch or upgrade to the latest release of EdgeConnect SD‑WAN Orchestrator provided by Hewlett Packard Enterprise.
  • If a patch is not yet available, limit access to the REST API by configuring firewall rules to allow only trusted IP ranges or by enforcing network segmentation.
  • Configure the API to require explicit authentication, enable MFA or token‑based mechanisms, and disable any default or anonymous endpoints to prevent unauthenticated access.

Generated by OpenCVE AI on August 4, 2026 at 19:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Hpe
Hpe edgeconnect Sd-wan Orchestrator
Vendors & Products Hpe
Hpe edgeconnect Sd-wan Orchestrator

Tue, 04 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
Title Authentication bypass via spoofed HTTP headers Orchestrator REST API
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Hpe Edgeconnect Sd-wan Orchestrator
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-08-04T17:33:01.785Z

Reserved: 2026-07-16T19:47:44.513Z

Link: CVE-2026-63455

cve-icon Vulnrichment

Updated: 2026-08-04T17:32:51.248Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-04T17:16:57.717

Modified: 2026-08-06T15:40:50.227

Link: CVE-2026-63455

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T10:19:45Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function