Critical [CVE-2026-63456] Authentication bypass via spoofed HTTP headers Orchestrator REST API
This critical-severity HPE Aruba Networking advisory covers CVE-2026-63456 affecting EdgeConnect.
Android app · Google Play
Monitor future HPE Aruba Networking CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
Affected product named by the advisory: EdgeConnect SD-WAN Orchestrator.
- EdgeConnect 9.6.2.00000 through 9.6.2.40208
- EdgeConnect 9.6.3.00000 through 9.6.3.40137
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
- EdgeConnect 9.7.0.43264 or above
- EdgeConnect 9.6.3.40140 or above
- EdgeConnect 9.6.2.40210 or above
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Upgrade affected HPE Aruba Networking devices to an applicable fixed release: EdgeConnect 9.7.0.43264 or above, EdgeConnect 9.6.3.40140 or above, EdgeConnect 9.6.2.40210 or above.
- In order to address the vulnerabilities described above for the affected software branches, HPE Aruba Networking recommends upgrading the software to one of the following versions (as applicable): - SD-WAN Orchestrator 9.7.0.x: 9.7.0.43264 and above - SD-WAN Orchestrator 9.6.3.x: 9.6.3.40140 and above - SD-WAN Orchestrator 9.6.2.x: 9.6.2.40210 and above Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ Product software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Support (EoST) milestone. For more information about HPE Aruba Networking EdgeConnect Product Lifecycle Policy, please visit: https://arubanetworking.hpe.com/techdocs/sdwan-PDFs/docs/eula/EC_LifecyclePolicy_latest.pdf
- To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Aruba Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage. As a best practice, it is recommended to configure IP-allow-listing for Orchestrator local users and API keys. You may contact HPE Services - HPE Aruba Networking for assistance if needed. For more information, please visit HPE Aruba Networking Support Portal at https://networkingsupport.hpe.com/home
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.