CVE-2026-63455: Aruba Authentication bypass via spoofed HTTP headers Orchestrator REST API
This Aruba advisory covers CVE-2026-63455 in EdgeConnect.
- CVE-2026-63455
Key facts
- Vendor rating
- Critical, CVSS 9.8
- CISA KEV
- Not listed (catalogue checked )
- Affected
- EdgeConnect 9.6.2.00000 through 9.6.2.40208; EdgeConnect 9.6.3.00000 through 9.6.3.40137
- Fixed in
- EdgeConnect 9.7.0.43264 or above, EdgeConnect 9.6.3.40140 or above, EdgeConnect 9.6.2.40210 or above
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
Affected product named by the advisory: EdgeConnect SD-WAN Orchestrator.
Text from the source record.
- EdgeConnect 9.6.2.00000 through 9.6.2.40208
- EdgeConnect 9.6.3.00000 through 9.6.3.40137
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-63455
Upgrade to a fixed release named by Aruba:
- EdgeConnect 9.7.0.43264 or above
- EdgeConnect 9.6.3.40140 or above
- EdgeConnect 9.6.2.40210 or above
Vendor guidance
- Upgrade affected HPE Aruba Networking devices to an applicable fixed release: EdgeConnect 9.7.0.43264 or above, EdgeConnect 9.6.3.40140 or above, EdgeConnect 9.6.2.40210 or above.
- In order to address the vulnerabilities described above for the affected software branches, HPE Aruba Networking recommends upgrading the software to one of the following versions (as applicable): - SD-WAN Orchestrator 9.7.0.x: 9.7.0.43264 and above - SD-WAN Orchestrator 9.6.3.x: 9.6.3.40140 and above - SD-WAN Orchestrator 9.6.2.x: 9.6.2.40210 and above Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ Product software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Support (EoST) milestone. For more information about HPE Aruba Networking EdgeConnect Product Lifecycle Policy, please visit: https://arubanetworking.hpe.com/techdocs/sdwan-PDFs/docs/eula/EC_LifecyclePolicy_latest.pdf
Workarounds
- To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Aruba Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage. As a best practice, it is recommended to configure IP-allow-listing for Orchestrator local users and API keys. You may contact HPE Services - HPE Aruba Networking for assistance if needed. For more information, please visit HPE Aruba Networking Support Portal at https://networkingsupport.hpe.com/home
More HPE Aruba Networking advisories
CVE-2026-63456Aug 4, 2026Authentication bypass via spoofed HTTP headers Orchestrator REST APICVE-2024-41134Jul 24, 2024vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command LineCVE-2026-95730Nov 3, 2026Authenticated Buffer OverflowCVE-2026-95729Nov 3, 2026Authenticated Sensitive Information Disclosure in VIACVE-2026-95728Nov 3, 2026Virtual Intranet Access: arbitrary file write vulnerability exists in the Virtual IntranetCVE-2026-95727Nov 3, 2026Authenticated Command Injection Vulnerability in HPE Networking VIA
HPE Aruba Networking advisories, August 2026All HPE Aruba Networking advisories
Get an email when Aruba EdgeConnect SD-WAN publishes the next one.
See Aruba EdgeConnect SD-WAN's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future HPE Aruba Networking CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
