VulnSocial

CVE-2026-63455Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 3d ago at 1 mentions (2026-08-04); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-08-04: 1Mentions · 2026-08-05: 1Mentions · 2026-08-13: 1Mentions · 2026-09-26: 1Patch / Workaround · 2026-08-13: 1Technical Details · 2026-08-04: 1Technical Details · 2026-08-05: 1Technical Details · 2026-08-13: 1Technical Details · 2026-09-26: 108-0408-0508-1309-26
Signal classification2 categories
Disclosure
375.0%
Patch
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-08-041
Disclosure1
2026-08-051
Disclosure1
2026-08-131
Patch1
2026-09-261
Disclosure1
Full discourse4 posts
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    CVE-2026-63455 and CVE-2026-63456 let attackers bypass web authentication on HPE EdgeConnect Orchestrator. CVSS 9.8. Patch now. #HPE #Aruba #SDWAN #CVE #CyberSecurity https://securityonline.info/edgeconnect-orchestrator-auth-bypass/

    Post summary

    The message highlights two high‑severity CVEs (CVE-2026-63455 and CVE-2026-63456) that allow attackers to bypass web authentication on HPE EdgeConnect Orchestrator; a patch is available immediately.

    01030548
    13.0K followersView on X
  • Moroco@xmoroco
    Disclosure

    Two CVEs I reported to HPE Aruba Networking just went public — CVE-2026-63455 and CVE-2026-63456, both CVSS 9.8. https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLocale=en_US https://t.co/iK1QMEN2ge

    Post summary

    Two high‑severity CVEs (CVE-2026-63455 and CVE-2026-63456) have been publicly disclosed with a reference to an HPE advisory; no PoC, exploit, or mitigation information is provided.

    0101084
    102 followersView on X
  • Autumn Good@autumn_good_35
    Disclosure

    🚨🚨🚨 『Authentication bypass via spoofed HTTP headers Orchestrator REST API (CVE-2026-63455, CVE-2026-63456)』 Multiple Vulnerabilities in HPE Aruba Networking SD-WAN Orchestrator 9.6.x Software Branch Only https://csaf.arubanetworking.hpe.com/2026/hpe_aruba_networking_-_hpesbnw05100.txt

    Post summary

    A new set of authentication bypass vulnerabilities (CVE-2026-63455 & CVE-2026-63456) has been disclosed for the HPE Aruba SD-WAN Orchestrator 9.6.x branch, linking to a CSAF advisory.

    00001546
    7.0K followersView on X
  • IntegSec@integ_sec
    Disclosure

    CVE-2026-63455: HPE SD-WAN Orchestrator Authentication Bypass - What It Means for Your Business and How to Respond https://hubs.li/Q04ynBdC0

    Post summary

    The tweet announces CVE-2026-63455 (HPE SD-WAN Orchestrator Authentication Bypass) and provides high-level technical details but lacks information on exploits, patches, or active exploitation, focusing instead on business impact and response guidance.

    0000046
    35 followersView on X

Explore more

Back to dashboard