CVE-2026-63455CWE-306

CVE-2026-63455

Critical · published August 4, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
56.0
In the wild
Unconfirmed
What it is

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00796 · 56.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-04T21:16Z
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 04 AUG 16:40Z
    Authentication bypass via spoofed HTTP headers Orchestrator REST API
    cvelistv5