Critical · published September 16, 2026
A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint. Successful exploitation could result in the disclosure of sensitive third-party API tokens and credentials, potentially enabling lateral movement to external security platforms.
| Product | Versions | Fixed in |
|---|---|---|
| arubanetworks/edgeconnect_sd-wan_orchestrator | ≥ 9.4.0, < 9.4.11 | 9.4.11 |
| arubanetworks/edgeconnect_sd-wan_orchestrator | ≥ 9.5.0, < 9.5.9 | 9.5.9 |
| arubanetworks/edgeconnect_sd-wan_orchestrator | ≥ 9.6.0, < 9.6.4 | 9.6.4 |
| arubanetworks/edgeconnect_sd-wan_orchestrator | all versions | — |
| hpe/edgeconnect_operating_system | ≥ 9.4.0.0, < 9.4.9.0 | 9.4.9.0 |
| hpe/edgeconnect_operating_system | ≥ 9.5.0.0, < 9.5.9.0 | 9.5.9.0 |
| hpe/edgeconnect_operating_system | ≥ 9.6.0.0, < 9.6.4.0 | 9.6.4.0 |
| hpe/edgeconnect_operating_system | all versions | — |