EUVD-2026-79230
GHSA-jhg9-vx7p-4jhm
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (hpe) · only source for this CVE.
CVSS VectorVendor: hpe
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Successful exploitation could allow an attacker to access sensitive information, potentially affecting the confidentiality and integrity of the data processed by the application.
AnalysisAI
Authenticated administrators of the HPE (Aruba) EdgeConnect SD-WAN Orchestrator web management interface can be tricked into running attacker-supplied script in their own browser session, exposing data handled by the management plane. The flaw is a cross-site scripting (CWE-79) issue rated CVSS 5.5 with a scope change (S:C), meaning the injected code runs in the victim's browser context rather than inside the orchestrator process itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today