Vulnerability · Published Aug 4, 2026 · Assigned by hpe

CVE-2026-63455Authentication bypass via spoofed HTTP headers Orchestrator REST API

Critical 9.8

In plain English

A critical-severity missing authentication in EdgeConnect SD-WAN Orchestrator from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.8%top 43.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

Affected products (as reported)

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	EdgeConnect SD-WAN Orchestrator	9.6.2.00000 – through 9.6.2.402089.6.3.00000 – through 9.6.3.40137

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLocale=en_US