EUVD-2026-79198
GHSA-c2cc-g2j3-9qhg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain read-only authenticated account
-
DeliverySend crafted request to cache-sync endpoint
-
ExploitDisclose stored third-party API tokens/credentials
-
ExecutionReuse leaked secrets against external platforms
-
ImpactLateral movement off appliance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account with only read-only privileges (PR:L) on the affected HPE Aruba EdgeConnect SD-WAN product; the attacker sends a specially crafted request to the specific cache synchronization endpoint to trigger disclosure. No user interaction is needed (UI:N) and it is network-reachable (AV:N). Limiting factors: exploitation is gated on possessing at least a low-privilege credential, so it is not pre-authenticated; realistic risk therefore scales with how widely low-privilege/read-only accounts are provisioned and whether the management interface is exposed. Affected versions per EUVD are EdgeConnect SD-WAN 9.4.0≤9.4.10, 9.5.0≤9.5.8, 9.6.0≤9.6.3, and 9.7.0. |
| Impact | This is authenticated (PR:L) network-exploitable information disclosure. The vendor CVSS of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) is inflated relative to the described behavior: the description is purely a read of sensitive configuration (third-party API tokens/credentials) via a crafted request to the cache synchronization endpoint, which cleanly supports a high confidentiality impact but provides no described mechanism for integrity modification (I:H) or availability degradation (A:L). The I:H/A:L components appear unsupported by the description and drive the score toward critical; assessed impact is confidentiality-only (~6.5). SSVC framework data (exploitation status, automatable, technical impact) is not provided. EPSS is absent, there is no CISA KEV listing, and no public exploit code is referenced - so exploitation status is: no public exploit identified at time of analysis. The genuine risk driver is the SECOND-ORDER impact: leaked third-party API tokens and credentials enable lateral movement to external security platforms, meaning a compromised low-privilege read-only account can pivot beyond the appliance. This is a real, prioritizable issue for organizations running affected EdgeConnect versions where low-privilege accounts are broadly provisioned, but the raw 9.9 overstates the on-box impact. Note the S:C (scope-changed) claim is defensible only through the downstream-credential-reuse argument, not through the base disclosure primitive itself. |
| Exploit ScenarioDerived | A low-privilege, read-only authenticated user (or an attacker who has phished/obtained such credentials) sends a specially crafted request to the SD-WAN Orchestrator's cache synchronization endpoint and receives back sensitive configuration data including third-party API tokens and credentials. The attacker then reuses those leaked secrets to authenticate to external security platforms integrated with the appliance, enabling lateral movement off-box. No public exploit code is identified at time of analysis, and exploitation requires valid (if minimal) authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Information disclosure in the HPE Aruba EdgeConnect SD-WAN Orchestrator allows a remote attacker holding only a valid read-only account to retrieve sensitive configuration data, including third-party API tokens and credentials, by sending a specially crafted request to the cache synchronization endpoint. The vendor-supplied score of 9.9 reflects a scope-changed vector with high confidentiality and integrity impact, whereas independent reassessment places the realistic impact at confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), because the flaw leaks data rather than altering system state. No CISA KEV entry and no public exploit code were identified at time of analysis, so the practical risk scales with how broadly low-privilege accounts are provisioned and whether the Orchestrator management interface is reachable from untrusted networks.
RemediationAI
No vendor-released patch version is identified in the supplied data at time of analysis, so the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US should be consulted directly to obtain the fixed release for each affected line (9.4.x, 9.5.x, 9.6.x and 9.7.x) and to confirm which builds address the cache synchronization endpoint - treat absence of a version here as a data gap, not as confirmation that no fix exists. Until the fixed build is deployed, apply compensating controls that directly target the two gating factors: first, restrict network access to the Orchestrator management interface so only trusted administrative networks or a VPN/jump host can reach it, which removes the AV:N path for external attackers but adds operational friction for remote administrators and automation; second, aggressively prune and review read-only accounts, since every low-privilege credential is a valid exploit prerequisite - disable unused read-only/service accounts and enforce least privilege, accepting that this may break monitoring or reporting integrations that depend on them. Because the disclosed data is third-party API tokens and credentials, assume exposure and rotate all tokens and credentials configured in the Orchestrator for external security platforms, and audit those platforms for unexpected API calls originating from the Orchestrator's source addresses; rotation carries a temporary integration outage risk and requires coordinated updates on the downstream platforms. Additionally, log and alert on requests to the cache synchronization endpoint, particularly from read-only principals, and segment the Orchestrator so that any lateral movement to external security platforms is constrained.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the SD-WAN Orchestrator (management/control plane) for HPE Aruba EdgeConnect SD-WAN, the same product family tracked in the EUVD record as EdgeConnect SD-WAN Gateways across the 9.4.x, 9.5.x, 9.6.x and 9.7.x maintenance lines. The vulnerable surface is the cache synchronization endpoint, which normally brokers cached configuration and integration state between Orchestrator components; the reported behavior indicates that this endpoint does not adequately enforce authorization or filter the fields returned, so a caller with read-only rights receives configuration objects it should not see. The exposed material is integration configuration - specifically third-party API tokens and credentials used by the Orchestrator to talk to external security platforms - which is why the vendor rated scope as changed and integrity impact as high, since stolen tokens can be replayed against those downstream services. The record carries no CWE assignment, so no root-cause class is officially declared; the described behavior is characteristic of an information exposure/improper authorization weakness in a cache/integration API. Independent assessment retains the authentication prerequisite (PR:L - a valid low-privilege, read-only account is required, so this is not pre-authentication), network reachability (AV:N), and no user interaction (UI:N), while narrowing impact to confidentiality-only (C:H/I:N/A:N) and scope-unchanged; that divergence with the vendor's 9.9 vector should be treated as a disagreement about downstream blast radius rather than about exploitability.
Know when Edgeconnect Sd Wan Orchestrator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Authenticated read-only access (PR:L) over network to a crafted-request disclosure; impact is confidentiality-only (C:H), with no described integrity/availability effect and no in-scope authority change (S:U).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint. Successful exploitation could result in the disclosure of sensitive third-party API tokens and credentials, potentially enabling lateral movement to external security platforms.
Executive ViewAI
A critical information-disclosure flaw in the HPE Aruba EdgeConnect SD-WAN Orchestrator lets anyone holding even a low-privilege read-only account pull sensitive configuration data, including third-party API tokens and credentials, out of the platform's cache synchronization endpoint. Because the Orchestrator is the control plane for wide-area network policy across branches and data centers, leaked tokens could give adversaries a foothold into connected third-party services and downstream network infrastructure. Security leadership should treat this as an exposure-management priority: no vendor patch exists yet, so risk is governed by how loosely read-only accounts are provisioned and how broadly the management interface is reachable.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Orchestrator management and cache-synchronization endpoint access to trusted networks only; aggressively minimize, review, and monitor read-only and other low-privilege accounts; rotate all third-party API tokens and credentials exposed to or stored by the Orchestrator; enable detailed logging and alerting on cache-synchronization requests; enforce MFA for all administrative access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution affects HPE Networking EdgeConnect SD-WAN Gateways running firmware in the 9.4.x,
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authe
Unauthenticated remote attackers can bypass authentication controls in the EdgeConnect SD-WAN Orchestrator management AP
Authentication bypass in the REST API interface of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauth
Authentication bypass in the REST API of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated
An Orchestrator service allows unauthenticated attackers to bypass MFA and create admin accounts without multi-factor au
Authenticated command injection in the command-line interface of HPE Aruba EdgeConnect SD-WAN Gateways allows an attacke
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated re
Low-privilege authenticated attackers can escalate to root on HPE Networking EdgeConnect SD-WAN Gateways by abusing an A
Privilege escalation in the EdgeConnect SD-WAN Gateway API lets a remote, authenticated low-privileged user gain adminis
A buffer overflow in the underlying operating system of HPE Aruba Networking EdgeConnect SD-WAN Gateways lets an unauthe
Exploit-DB