What is the CVSS score of CVE-2026-63456?

CVE-2026-63456 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of EdgeConnect SD-WAN Orchestrator are affected by CVE-2026-63456?

HPE Aruba EdgeConnect SD-WAN Orchestrator is vulnerable to unauthenticated remote access allowing attackers to read and modify critical network configuration without credentials.

How to fix or mitigate CVE-2026-63456?

Within 24 hours: identify all EdgeConnect Orchestrator instances accessible over the network and immediately apply firewall restrictions to block unauthorized REST API access, limiting connections to trusted administrative networks only. Within 7 days: enable detailed logging and alerting on all REST API activity, apply any available EdgeConnect updates from HPE, and review access logs for signs of exploitation or reconnaissance. Within 30 days: establish continuous monitoring of HPE security advisories for patch availability, implement a Web Application Firewall with API-level protections, and develop an incident response plan specific to unauthorized orchestrator access.

EdgeConnect SD-WAN Orchestrator CVE-2026-63456

EUVD-2026-52791 CRITICAL

Improper Authentication (CWE-287)

2026-08-04 hpe

GHSA-vcr7-c38x-xvhq

Authentication Bypass Edgeconnect Sd Wan Orchestrator Hewlett Packard Enterprise Hpe

9.8

CVSS 3.1 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network REST API bypass gives full read (C:H) and modify (I:H) of orchestrator data; description cites no service disruption so A:N rather than the input's A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hpe).

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 17:35 vuln.today

CVE Published

Aug 04, 2026 - 16:41 cve.org

CRITICAL 9.8

DescriptionCVE.org

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

AnalysisAI

Authentication bypass in the REST API interface of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and data on the orchestrator. HPE reports the flaw as a cluster of multiple REST API weaknesses rated critical (CVSS 9.8). No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch target for any organization running the orchestrator.

Technical ContextAI

EdgeConnect SD-WAN Orchestrator (formerly Silver Peak Unity Orchestrator, acquired by HPE/Aruba) is the centralized management and control plane for EdgeConnect SD-WAN fabrics, administering policy, topology, and configuration for distributed appliances via a web UI and REST API. The vulnerability class here is authentication/authorization bypass (CWE-287/CWE-288-family, though NVD lists CWE as N/A) in the REST API layer: one or more endpoints fail to properly enforce session or credential validation, so requests that should require an authenticated administrative session are honored without one. Because the orchestrator holds fabric-wide configuration and secrets, a bypass at this layer exposes the management plane of an entire SD-WAN deployment. The affected CPE is cpe:2.3:a:hewlett_packard_enterprise_(hpe):edgeconnect_sd-wan_orchestrator, i.e. the software/appliance orchestrator product, not the edge devices themselves.

RemediationAI

Apply the fixed EdgeConnect SD-WAN Orchestrator release identified in HPE security bulletin hpesbnw05100en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLocale=en_US); the provided data does not include an exact fix version, so use the advisory to determine the target build for your deployment - do not rely on an assumed version number. Until patched, reduce exposure by restricting network reachability of the orchestrator's web and REST API interfaces: place the orchestrator behind a VPN or management VLAN and use firewall/ACL rules to permit management access only from known administrator IP ranges, which blocks unauthenticated internet-based access at the cost of requiring admins to be on the trusted network. If the orchestrator is cloud-hosted or SaaS-managed by HPE, confirm with the vendor whether the fix has already been applied on their side. Monitor REST API and authentication logs for anomalous unauthenticated requests to sensitive endpoints as a detective control.