VulnSocial

CVE-2026-63456Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 1 mentions (2026-08-04); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-08-04: 1Mentions · 2026-08-05: 1Mentions · 2026-08-13: 1Patch / Workaround · 2026-08-13: 1Technical Details · 2026-08-04: 1Technical Details · 2026-08-05: 1Technical Details · 2026-08-13: 108-0408-0508-13
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-08-041
Disclosure1
2026-08-051
Disclosure1
2026-08-131
Patch1
Full discourse3 posts
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    CVE-2026-63455 and CVE-2026-63456 let attackers bypass web authentication on HPE EdgeConnect Orchestrator. CVSS 9.8. Patch now. #HPE #Aruba #SDWAN #CVE #CyberSecurity https://securityonline.info/edgeconnect-orchestrator-auth-bypass/

    Post summary

    The tweet alerts that CVE‑2026‑63455 and CVE‑2026‑63456 allow bypass of web authentication on HPE EdgeConnect Orchestrator, assigns a CVSS score of 9.8, and urges immediate patching.

    01030548
    13.0K followersView on X
  • Moroco@xmoroco
    Disclosure

    Two CVEs I reported to HPE Aruba Networking just went public — CVE-2026-63455 and CVE-2026-63456, both CVSS 9.8. https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLocale=en_US https://t.co/iK1QMEN2ge

    Post summary

    Two new, high‑severity CVEs (CVE‑2026‑63455 and CVE‑2026‑63456) have been publicly disclosed via an HPE Aruba Networking support document.

    0101084
    102 followersView on X
  • Autumn Good@autumn_good_35
    Disclosure

    🚨🚨🚨 『Authentication bypass via spoofed HTTP headers Orchestrator REST API (CVE-2026-63455, CVE-2026-63456)』 Multiple Vulnerabilities in HPE Aruba Networking SD-WAN Orchestrator 9.6.x Software Branch Only https://csaf.arubanetworking.hpe.com/2026/hpe_aruba_networking_-_hpesbnw05100.txt

    Post summary

    The tweet announces that HPE Aruba networking SD-WAN Orchestrator 9.6.x is vulnerable to authentication bypass via spoofed HTTP headers, referencing CVE‑2026‑63455/63456, with no PoC, patch, or exploitation details provided.

    00001546
    7.0K followersView on X

Explore more

Back to dashboard