What is CVE-2026-63456?

CVE-2026-63456 is a critical-severity vulnerability in Hewlett Packard Enterprise (HPE) Edgeconnect Sd-Wan Orchestrator, classified under Improper Authentication. CVSS score: 9.8/10. Published 2026-08-04.

How severe is CVE-2026-63456?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Hewlett Packard Enterprise (HPE) Edgeconnect Sd-Wan Orchestrator

CVE-2026-63456

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

Vulnerability class: Broken Authentication

EPSS: 0.004 (36.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Hewlett Packard Enterprise (Hpe) Edgeconnect Sd-wan Orchestrator — versions 9.6.2.00000, 9.6.3.00000

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

security-alert@hpe.com

Frequently asked questions

What is CVE-2026-63456?: CVE-2026-63456 is a critical-severity vulnerability in Hewlett Packard Enterprise (HPE) Edgeconnect Sd-Wan Orchestrator, classified under Improper Authentication. CVSS score: 9.8/10. Published 2026-08-04.
How severe is CVE-2026-63456?: Critical severity. CVSS v3 base score is 9.8 out of 10.