HPE Aruba SD-WAN Orchestrator Multiple CVEs Pre-Auth Bypass Security Advisory

Vulnerability Overview HPE Aruba Networking has released patches for the HPE Networking SD-WAN Orchestrator 9.6.x software branch to address multiple security vulnerabilities. These vulnerabilities allow unauthenticated remote attackers to bypass web authentication mechanisms and access system functionality. Successful exploitation of these vulnerabilities may enable attackers to view and modify sensitive information on the target system. Affected Versions Affected software versions: - SD-WAN Orchestrator 9.6.2.x: 9.6.2.40208 and earlier - SD-WAN Orchestrator 9.6.3.x: 9.6.3.40137 and earlier Unaffected software versions: - Any other HPE Aruba Networking products not listed above are not affected by these vulnerabilities. Remediation Recommended measures: - Restrict CLI and web-based management interfaces to a dedicated Layer 2 segment/VLAN and enforce control at Layer 3 via firewall policies. Additionally, enable audit trails for Orchestrator local users and API keys. - Configure IP whitelisting to restrict access to Orchestrator local users and API keys. Software upgrades: - Upgrade to one of the following versions (where applicable): - SD-WAN Orchestrator 9.7.0.x: 9.7.0.43264 and later - SD-WAN Orchestrator 9.6.3.x: 9.6.3.40140 and later - SD-WAN Orchestrator 9.6.2.x: 9.6.2.40210 and later Download links: - Software versions containing the fixes can be downloaded from the HPE Networking Support Portal: https://networkingsupport.hpe.com/home Additional Information CVSS scores: - CVE-2026-63455: CVSS 3.1 Base Score 9.8 - CVE-2026-63456: CVSS 3.1 Base Score 9.8 Discoverer: - These vulnerabilities were discovered and reported by Christopher Alejandro (Moroco) through the HPE Aruba Networking Bug Bounty program. References: - CVE-2026-63455 - CVE-2026-63456 Background: - HPE calculates CVSS scores using CVSS Version 3.1. If a score is provided by NIST, the NVD-provided Version 3.1 score will be displayed. History: - Version 1 (Revision 1): First released on June 4, 2026 Third-party patches: - Third-party security patches should be installed on systems running Hewlett Packard Enterprise (HPE) software products in accordance with the customer's patch management policy. Support and reporting: - For questions regarding the implementation of recommendations in this security advisory, please contact standard HPE service support channels. - To report potential security vulnerabilities, visit: https://www.hpe.com/info/support/security-vulnerability Subscription: - To subscribe to receive future HPE security advisories, visit: http://www.hpe.com/support/Subscriber_Choice Advisory archive: - A list of recently published security advisories can be viewed at the following link: http://www.hpe.com/support/Security_Bulletin_Archive Disclaimer: - HPE makes no warranties, express or implied, regarding the accuracy, completeness, or applicability of the information in this security advisory. HPE is not liable for any damages resulting from the use of or reliance upon the information in this security advisory. --- Note: No Proof of Concept (POC) code or exploitation code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

HPE Aruba SD-WAN Orchestrator Multiple CVEs Pre-Auth Bypass Security Advisory

More from this source