CVE-2026-63455

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLocale=en_US

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Múltiples vulnerabilidades en la interfaz REST API de HPE Networking SD-WAN Orchestrator podrían permitir a un atacante remoto no autenticado eludir los mecanismos de autenticación web y acceder a funciones del sistema. Una explotación exitosa podría permitir a un atacante ver y modificar información potencialmente sensible en el sistema objetivo.

Information

Published : 2026-08-04 17:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-63455

Mitre link : CVE-2026-63455

CVE.ORG link : CVE-2026-63455

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-63455", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63455", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-04T17:30:54.410654Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-alert@hpe.com", "affectedData": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "EdgeConnect SD-WAN Orchestrator", "versions": [{"status": "affected", "version": "9.6.2.00000", "versionType": "semver", "lessThanOrEqual": "9.6.2.40208"}, {"status": "affected", "version": "9.6.3.00000", "versionType": "semver", "lessThanOrEqual": "9.6.3.40137"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-04T17:16:57.717", "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLocale=en_US", "source": "security-alert@hpe.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades en la interfaz REST API de HPE Networking SD-WAN Orchestrator podr\u00edan permitir a un atacante remoto no autenticado eludir los mecanismos de autenticaci\u00f3n web y acceder a funciones del sistema. Una explotaci\u00f3n exitosa podr\u00eda permitir a un atacante ver y modificar informaci\u00f3n potencialmente sensible en el sistema objetivo."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "security-alert@hpe.com"}