EUVD-2026-79198
GHSA-c2cc-g2j3-9qhg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Authenticated read-only access (PR:L) over network to a crafted-request disclosure; impact is confidentiality-only (C:H), with no described integrity/availability effect and no in-scope authority change (S:U).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint. Successful exploitation could result in the disclosure of sensitive third-party API tokens and credentials, potentially enabling lateral movement to external security platforms.
AnalysisAI
Information disclosure in the HPE Aruba EdgeConnect SD-WAN Orchestrator allows a remote attacker holding only a valid read-only account to retrieve sensitive configuration data, including third-party API tokens and credentials, by sending a specially crafted request to the cache synchronization endpoint. The vendor-supplied score of 9.9 reflects a scope-changed vector with high confidentiality and integrity impact, whereas independent reassessment places the realistic impact at confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), because the flaw leaks data rather than altering system state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated account with only read-only privileges (PR:L) on the affected HPE Aruba EdgeConnect SD-WAN product; the attacker sends a specially crafted request to the specific cache synchronization endpoint to trigger disclosure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is authenticated (PR:L) network-exploitable information disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the supplied data at time of analysis, so the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US should be consulted directly to obtain the fixed release for each affected line (9.4.x, 9.5.x, 9.6.x and 9.7.x) and to confirm which builds address the cache synchronization endpoint - treat absence of a version here as a data gap, not as confirmation that no fix exists. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which HPE Aruba EdgeConnect SD-WAN Orchestrator instances are internet- or untrusted-network-reachable and immediately restrict management and cache-synchronization endpoint access to trusted administrative networks via firewall, ACL, or VPN-only access; inventory every account with read-only or higher privileges on the Orchestrator and disable or suspend any that are unused, shared, or not strictly required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S
A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
NTP through 4.2.8p12 has a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenti
Remote authentication bypass in HPE AutoPass License Server (APLS) allows unauthenticated network attackers to circumven
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authe
Command Injection Rce (3Rd) in HPE StoreOnce backup storage software. One of 6 critical CVEs.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today