CVE-2026-63455

Authentication bypass via spoofed HTTP headers Orchestrator REST API

State: Published
Severity: 9.8 Critical
Published: Aug 4, 2026
Updated: Aug 4, 2026
Reserved: Jul 16, 2026

Description

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	hpe

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
EdgeConnect SD-WAN OrchestratorHewlett Packard Enterprise (HPE)	9.6.2.00000 through 9.6.2.40208Affected 9.6.3.00000 through 9.6.3.40137Affected

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLocale=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.