The API of HPE Networking EdgeConnect SD‑WAN Orchestrator contains an authentication bypass flaw (CWE‑287) that allows an unauthenticated remote actor to bypass existing authentication checks. Successful exploitation lets the attacker acquire administrative privileges, giving full control over the Or compromise of the host, including configuration tampering, data exfiltration, and service disruption.

Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways are affected. The flaw applies to any deployment where the Orchestrator API is exposed to a network that an attacker can reach. No specific product versions are listed in the advisory.

The CVSS base score of 8.1 indicates high severity. The EPSS score of 0.00462 (about 0.46%) suggests that exploitation is currently rare but still possible, especially for exposed deployments. The vulnerability is not listed in CISA KEV. Because the attack requires only network access to the unsecured API endpoint and no prior authentication, the risk remains high for exposed environments, and a remote attacker could achieve full system compromise.