Loading story…
Hewlett Packard Enterprise disclosed multiple high-severity vulnerabilities in HPE EdgeConnect SD-WAN Orchestrator that can let an unauthenticated remote attacker bypass web authentication by spoofing HTTP headers in the product's REST API. The issues, tracked as CVE-2026-63455 and CVE-2026-63456, could expose system functions and allow viewing or modification of sensitive information, with potential impact to confidentiality, integrity, and availability. Both CVEs carry a CVSS v3.1 rating of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected releases include 9.6.2.00000 through 9.6.2.40208 and 9.6.3.00000 through 9.6.3.40137, which Canadian Centre for Cyber Security guidance summarized as 9.6.2.40208 and earlier and 9.6.3.40137 and earlier. HPE's bulletin HPESBNW05100 rev.1 and related government advisories urge administrators to review the vendor guidance and apply updates as they become available to reduce exposure in internet-reachable orchestration environments.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On August 5, 2026, the Canadian Centre for Cyber Security published advisory AV26-778 warning that HPE EdgeConnect SD-WAN Orchestrator 9.6.2.40208 and earlier and 9.6.3.40137 and earlier are affected by multiple vulnerabilities. The notice referenced HPE bulletin HPESBNW05100 rev.1 and advised users to review guidance and apply updates when available.
The CVE record states that CVE-2026-63456 was received by security-alert@hpe.com on August 4, 2026. It describes multiple REST API vulnerabilities in HPE EdgeConnect SD-WAN Orchestrator that could allow unauthenticated authentication bypass and access to system functions.
The CVE record states that CVE-2026-63455 was received by security-alert@hpe.com on August 4, 2026. It describes multiple REST API vulnerabilities in HPE EdgeConnect SD-WAN Orchestrator that could allow unauthenticated authentication bypass and access to system functions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HPE issued security advisories for vulnerabilities affecting two telecom orchestration products: **HPE Telco Service Orchestrator** and **HPE Telco Network Function Virtualization Orchestrator**. The first bulletin, `HPESBNW05031 rev.1`, covers multiple vulnerabilities in HPE Telco Service Orchestrator versions prior to **v5.5.1**, while a separate advisory addresses a **critical** flaw in HPE Telco Network Function Virtualization Orchestrator affecting **v7.5.0 and earlier**. The critical issue in HPE Telco Network Function Virtualization Orchestrator was tied to **improper input validation** in the **Undertow HTTP Server Core**. The Canadian Centre for Cyber Security urged organizations using either product to review HPE’s security bulletins and apply the required updates to remediate the exposed versions.
Jul 1, 2026
HPE issued security advisories covering multiple vulnerabilities in **HPE Telco Network Function Virtualization Orchestrator** and **HPE Aruba Networking ArubaOS-CX Switches**, including critical issues affecting Telco NFV Orchestrator `7.6.0` and earlier. The ArubaOS-CX advisories affect several software branches, including `10.16.1000` and earlier, `10.15.0005` and earlier, and `10.13.1080` and earlier, prompting guidance for customers to review vendor bulletins and deploy updates. The disclosures also include bulletin **`HPESBNW05062 rev.1`**, which addresses the status of the **OpenSSH Keystroke Obfuscation Bypass** vulnerability, tracked as **`CVE-2024-39894`**, on ArubaOS-CX. Canada’s Centre for Cyber Security echoed the HPE notice and urged administrators to consult the linked advisories and apply the recommended remediations to affected networking and orchestration platforms.
Jun 29, 2026
Hewlett Packard Enterprise released security updates for **HPE Networking Instant On Access Points** to fix two vulnerabilities affecting firmware version `3.2.0.1` and earlier. The most severe issue, **`CVE-2025-37103`**, is a critical hard-coded credentials flaw with a **CVSS score of 9.8** that could allow a remote attacker to gain administrative access to the device web interface. HPE documented the issues in security bulletin **`HPESBNW04894`** and urged customers to update affected systems. HPE also patched **`CVE-2025-37102`**, a high-severity vulnerability with a **CVSS score of 7.2** that allows a remote authenticated attacker to inject arbitrary commands into the device console and execute commands on the underlying system. The company recommended immediate upgrades to firmware version `3.2.1.0` or later to reduce the risk of unauthorized access and command execution on exposed access points.
Jul 24, 2026