CVE-2026-63455 — Authentication bypass via spoofed HTTP headers Orchestrator REST API

CVE-2026-63455

Authentication bypass via spoofed HTTP headers Orchestrator REST API PUBLISHED

Description (CNA)

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

Affected (CNA)

Vendor / product	Versions
Hewlett Packard Enterprise (HPE) / EdgeConnect SD-WAN Orchestrator	affected 9.6.2.00000 through 9.6.2.40208; affected 9.6.3.00000 through 9.6.3.40137

CWE

No CWE identifiers supplied.

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLocale=en_US

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.