A vulnerability in the HPE EdgeConnect SD‑WAN Orchestrator allows an authenticated remote attacker with read‑only privileges to send a specially crafted request to the cache synchronization endpoint. This can expose sensitive third‑party API tokens and credentials, creating a path for lateral movement to external security platforms. The weakness results in the disclosure of confidential configuration and credential data, which can be leveraged for further compromise.

The affected product is Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways. The specific versions impacted are not listed in the data, so all current releases of the SD‑WAN Orchestrator are presumed at risk until an official fix is provided.

The CVSS score of 9.9 indicates a critical severity, while the EPSS score is not available; the lack of a CISA KEV listing does not mean the flaw is unexploitable. The attack vector is remote, requiring only authenticated access with read‑only rights, which are granted to many users by default. Once hijacked, an attacker can retrieve sensitive tokens that could be used to compromise other network infrastructure or external services. The threat is therefore high, especially in environments where read‑only accounts are widely used or where sensitive tokens are stored in configuration files.