EUVD-2026-52790
GHSA-883w-8c8j-j55v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Orchestrator REST API over network
-
DeliverySend crafted request bypassing web auth
-
ExploitAccess privileged system functions unauthenticated
-
ExecutionRead sensitive SD-WAN configuration
-
ImpactModify orchestrator/fabric settings
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The prerequisite is network reachability to the EdgeConnect SD-WAN Orchestrator's REST API interface; per CVSS AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special product configuration called out in the description - exploitation targets the standard REST API exposure. The primary limiting factor is therefore network exposure: deployments where the Orchestrator management/API interface is segmented, VPN-gated, or firewalled off from untrusted networks sharply reduce realistic attack surface, whereas any internet-facing or flat-network Orchestrator is directly exploitable. No platform-, version-, or feature-toggle condition is documented in the available data. |
| Impact | All available signals point to genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact (9.8 Critical). Because this is a network management orchestrator, compromise cascades across every managed SD-WAN edge, amplifying real-world impact beyond a single host. Tempering the urgency: EPSS is not provided, there is no POC and no CISA KEV listing, so exploitation is not confirmed in the wild - the risk here is derived from the ease-of-exploitation profile, not observed attacks. The vendor-tagged impact ('Information Disclosure') is narrower than the CVSS 'view and modify' + high-availability scoring implies; this is a mild inconsistency worth verifying against the HPE advisory, as CVSS A:H suggests more than pure disclosure. |
| Exploit ScenarioDerived | An attacker who can reach the Orchestrator's REST API over the network sends crafted requests that skip the authentication check, landing directly on privileged system functions with no credentials or user interaction. From there they read sensitive SD-WAN configuration and secrets and modify fabric settings, potentially re-routing or degrading traffic across all managed edge appliances. No public POC is known, but the low-complexity, unauthenticated vector means weaponization would be straightforward if internal details surface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 04, 2026
Authentication bypass in the REST API of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and network data. HPE (the reporting vendor) rates it CVSS 9.8 with a fully remote, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitation profile on an internet-facing management plane makes it a high patch priority.
RemediationAI
Patch available per vendor advisory - apply the fixed Orchestrator release specified in HPE Security Bulletin hpesbnw05100en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLocale=en_US); no exact fix version was included in the provided data, so pull it directly from that bulletin rather than relying on an assumed number. Until patched, restrict network exposure of the Orchestrator management interface: place it behind VPN/management-VLAN segmentation and firewall the REST API/HTTPS management port so it is not reachable from untrusted or internet-facing networks, and limit source IPs to known administrative hosts (trade-off: remote/cloud-hosted or MSP-managed Orchestrator deployments may need allowlist adjustments and could disrupt automation integrations that call the API). Monitor Orchestrator API and authentication logs for anomalous unauthenticated access to privileged endpoints as a detective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EdgeConnect SD-WAN Orchestrator (the former Silver Peak/Aruba Orchestrator) is the centralized management and provisioning plane for HPE's EdgeConnect SD-WAN fabric, controlling policy, tunnels, and configuration across distributed appliances. The flaw is in its REST API interface, where the authentication layer can be bypassed - behavior consistent with the CWE-287/CWE-288 (Improper Authentication / Authentication Bypass Using an Alternate Path) class, where an alternate request path or missing check reaches privileged endpoints without a validated session. The affected component is identified by CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):edgeconnect_sd-wan_orchestrator, and the vendor tags the impact as Information Disclosure. The upstream CWE was published as N/A, so the exact weakness class is inferred from the description rather than vendor-assigned.
Know when Edgeconnect Sd Wan Orchestrator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable REST API auth bypass (AV:N/AC:L/PR:N/UI:N) granting read and modify over a critical orchestrator justifies C:H/I:H, with A:H retained per vendor scoring of full config control.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
Executive ViewAI
HPE EdgeConnect SD-WAN Orchestrator contains a critical remote authentication bypass (CVSS 9.8) enabling unauthenticated attackers to directly access protected management functions and modify network configuration and routing policies. Any organization operating internet-facing instances faces immediate risk of SD-WAN compromise affecting enterprise-wide network traffic control and business continuity. No vendor patch is currently available, requiring urgent implementation of compensating controls.
Restrict network access to REST API endpoints via firewall segmentation or air-gapping to private administrative networks only; deploy Web Application Firewall (WAF) with authentication-enforcement and API access control rules; enable detailed audit logging of all REST API requests, authentication attempts, and configuration changes; restrict REST API endpoints to minimum-required functionality through vendor configuration if available; implement endpoint detection and response (EDR) monitoring for suspicious management interface activity; establish API usage baselines to detect anomalous access patterns indicative of exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote code execution affects HPE Networking EdgeConnect SD-WAN Gateways running firmware in the 9.4.x,
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authe
Information disclosure in the HPE Aruba EdgeConnect SD-WAN Orchestrator allows a remote attacker holding only a valid re
Unauthenticated remote attackers can bypass authentication controls in the EdgeConnect SD-WAN Orchestrator management AP
Authentication bypass in the REST API interface of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauth
An Orchestrator service allows unauthenticated attackers to bypass MFA and create admin accounts without multi-factor au
Authenticated command injection in the command-line interface of HPE Aruba EdgeConnect SD-WAN Gateways allows an attacke
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated re
Low-privilege authenticated attackers can escalate to root on HPE Networking EdgeConnect SD-WAN Gateways by abusing an A
Privilege escalation in the EdgeConnect SD-WAN Gateway API lets a remote, authenticated low-privileged user gain adminis
A buffer overflow in the underlying operating system of HPE Aruba Networking EdgeConnect SD-WAN Gateways lets an unauthe
Exploit-DB