EUVD-2026-52791
GHSA-vcr7-c38x-xvhq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach orchestrator REST API over network
-
DeliverySend crafted request bypassing auth
-
ExploitAccess protected system functions
-
ExecutionRead sensitive SD-WAN configuration
-
ImpactModify configuration or credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the EdgeConnect SD-WAN Orchestrator's REST API interface; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are needed - this is unauthenticated remote exploitation against the exposed REST API. The primary limiting factor is therefore network exposure: if the orchestrator's management/REST interface is not reachable by the attacker (segmented behind VPN, management VLAN, or firewall ACLs), exploitation is prevented. No non-default feature toggle or specific deployment mode is called out in the description as a prerequisite. |
| Impact | All raw signals point to genuine high priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated, no-user-interaction exploitation with high confidentiality and integrity impact - the canonical 9.8 profile for a management-plane auth bypass. There is no EPSS score, no POC, and no CISA KEV entry in the provided data, so exploitation probability cannot be quantified and there is no evidence of active exploitation yet; the score reflects potential, not observed, attack activity. One point warrants verification: the vendor description emphasizes viewing and modifying sensitive information (confidentiality and integrity) but does not describe service disruption, so the A:H availability rating in the input is not clearly justified by the text - treat availability impact as unconfirmed. Even discounting availability, an unauthenticated bypass on an internet-or-management-network-reachable SD-WAN orchestrator is a top-tier fix. |
| Exploit ScenarioDerived | An attacker who can reach the orchestrator's REST API over the network sends crafted requests to endpoints that should require an authenticated admin session, bypassing the web authentication check entirely. With that access they enumerate and read sensitive SD-WAN configuration and then modify it - altering policies, routing, or credentials across the managed fabric. No POC is present in the provided data, but the low attack complexity and lack of authentication or user interaction make weaponization straightforward once endpoint details are known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 04, 2026
Authentication bypass in the REST API interface of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and data on the orchestrator. HPE reports the flaw as a cluster of multiple REST API weaknesses rated critical (CVSS 9.8). No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch target for any organization running the orchestrator.
RemediationAI
Apply the fixed EdgeConnect SD-WAN Orchestrator release identified in HPE security bulletin hpesbnw05100en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLocale=en_US); the provided data does not include an exact fix version, so use the advisory to determine the target build for your deployment - do not rely on an assumed version number. Until patched, reduce exposure by restricting network reachability of the orchestrator's web and REST API interfaces: place the orchestrator behind a VPN or management VLAN and use firewall/ACL rules to permit management access only from known administrator IP ranges, which blocks unauthenticated internet-based access at the cost of requiring admins to be on the trusted network. If the orchestrator is cloud-hosted or SaaS-managed by HPE, confirm with the vendor whether the fix has already been applied on their side. Monitor REST API and authentication logs for anomalous unauthenticated requests to sensitive endpoints as a detective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EdgeConnect SD-WAN Orchestrator (formerly Silver Peak Unity Orchestrator, acquired by HPE/Aruba) is the centralized management and control plane for EdgeConnect SD-WAN fabrics, administering policy, topology, and configuration for distributed appliances via a web UI and REST API. The vulnerability class here is authentication/authorization bypass (CWE-287/CWE-288-family, though NVD lists CWE as N/A) in the REST API layer: one or more endpoints fail to properly enforce session or credential validation, so requests that should require an authenticated administrative session are honored without one. Because the orchestrator holds fabric-wide configuration and secrets, a bypass at this layer exposes the management plane of an entire SD-WAN deployment. The affected CPE is cpe:2.3:a:hewlett_packard_enterprise_(hpe):edgeconnect_sd-wan_orchestrator, i.e. the software/appliance orchestrator product, not the edge devices themselves.
Know when Edgeconnect Sd Wan Orchestrator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network REST API bypass gives full read (C:H) and modify (I:H) of orchestrator data; description cites no service disruption so A:N rather than the input's A:H.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
Executive ViewAI
HPE Aruba EdgeConnect SD-WAN Orchestrator is vulnerable to unauthenticated remote access allowing attackers to read and modify critical network configuration without credentials. Organizations deploying this orchestrator to manage their SD-WAN infrastructure face immediate risk of network reconfiguration, service disruption, or data exfiltration-with no vendor patch currently available to remediate the vulnerability.
Restrict REST API network access to authorized administration networks via firewall; deploy Web Application Firewall (WAF) with API protection rules; enable comprehensive API request logging and real-time alerting; implement API rate limiting; disable unused API endpoints; maintain close monitoring of HPE advisories for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote code execution affects HPE Networking EdgeConnect SD-WAN Gateways running firmware in the 9.4.x,
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authe
Information disclosure in the HPE Aruba EdgeConnect SD-WAN Orchestrator allows a remote attacker holding only a valid re
Unauthenticated remote attackers can bypass authentication controls in the EdgeConnect SD-WAN Orchestrator management AP
Authentication bypass in the REST API of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated
An Orchestrator service allows unauthenticated attackers to bypass MFA and create admin accounts without multi-factor au
Authenticated command injection in the command-line interface of HPE Aruba EdgeConnect SD-WAN Gateways allows an attacke
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated re
Low-privilege authenticated attackers can escalate to root on HPE Networking EdgeConnect SD-WAN Gateways by abusing an A
Privilege escalation in the EdgeConnect SD-WAN Gateway API lets a remote, authenticated low-privileged user gain adminis
A buffer overflow in the underlying operating system of HPE Aruba Networking EdgeConnect SD-WAN Gateways lets an unauthe
Exploit-DB