What is the CVSS score of CVE-2026-63455?

CVE-2026-63455 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of EdgeConnect SD-WAN Orchestrator are affected by CVE-2026-63455?

HPE EdgeConnect SD-WAN Orchestrator contains a critical remote authentication bypass (CVSS 9.8) enabling unauthenticated attackers to directly access protected management functions and modify network…

How to fix or mitigate CVE-2026-63455?

Within 24 hours: inventory all internet-facing EdgeConnect Orchestrator REST API endpoints and immediately restrict network access to authorized administrative networks only via firewall rules or network segmentation; disable external management access if operationally feasible. Within 7 days: contact HPE support to confirm patch timeline and interim security recommendations, implement comprehensive API request logging and alerting for unauthorized access attempts, enable multi-factor authentication on any administrator accounts if supported, and deploy a Web Application Firewall (WAF) with rules enforcing authentication for all management endpoints. Within 30 days: establish daily patch status tracking with HPE, prepare a full patch deployment and rollback procedure, test interim controls effectiveness through security assessment, and evaluate risk acceptance or alternative SD-WAN vendors if patch timeline extends beyond your risk threshold.

EdgeConnect SD-WAN Orchestrator CVE-2026-63455

EUVD-2026-52790 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-08-04 hpe

GHSA-883w-8c8j-j55v

Authentication Bypass Edgeconnect Sd Wan Orchestrator Hewlett Packard Enterprise Hpe

9.8

CVSS 3.1 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable REST API auth bypass (AV:N/AC:L/PR:N/UI:N) granting read and modify over a critical orchestrator justifies C:H/I:H, with A:H retained per vendor scoring of full config control.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hpe).

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 17:37 vuln.today

CVE Published

Aug 04, 2026 - 16:40 cve.org

CRITICAL 9.8

DescriptionCVE.org

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

AnalysisAI

Authentication bypass in the REST API of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and network data. HPE (the reporting vendor) rates it CVSS 9.8 with a fully remote, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitation profile on an internet-facing management plane makes it a high patch priority.

Technical ContextAI

EdgeConnect SD-WAN Orchestrator (the former Silver Peak/Aruba Orchestrator) is the centralized management and provisioning plane for HPE's EdgeConnect SD-WAN fabric, controlling policy, tunnels, and configuration across distributed appliances. The flaw is in its REST API interface, where the authentication layer can be bypassed - behavior consistent with the CWE-287/CWE-288 (Improper Authentication / Authentication Bypass Using an Alternate Path) class, where an alternate request path or missing check reaches privileged endpoints without a validated session. The affected component is identified by CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):edgeconnect_sd-wan_orchestrator, and the vendor tags the impact as Information Disclosure. The upstream CWE was published as N/A, so the exact weakness class is inferred from the description rather than vendor-assigned.

RemediationAI

Patch available per vendor advisory - apply the fixed Orchestrator release specified in HPE Security Bulletin hpesbnw05100en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLocale=en_US); no exact fix version was included in the provided data, so pull it directly from that bulletin rather than relying on an assumed number. Until patched, restrict network exposure of the Orchestrator management interface: place it behind VPN/management-VLAN segmentation and firewall the REST API/HTTPS management port so it is not reachable from untrusted or internet-facing networks, and limit source IPs to known administrative hosts (trade-off: remote/cloud-hosted or MSP-managed Orchestrator deployments may need allowlist adjustments and could disrupt automation integrations that call the API). Monitor Orchestrator API and authentication logs for anomalous unauthenticated access to privileged endpoints as a detective control.