High · published September 16, 2026
Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery (SSRF) attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information beyond what is authorized by the user's existing privilege level.
| Product | Versions | Fixed in |
|---|---|---|
| arubanetworks/edgeconnect_sd-wan_orchestrator | ≥ 9.4.0, < 9.4.11 | 9.4.11 |
| arubanetworks/edgeconnect_sd-wan_orchestrator | ≥ 9.5.0, < 9.5.9 | 9.5.9 |
| arubanetworks/edgeconnect_sd-wan_orchestrator | ≥ 9.6.0, < 9.6.4 | 9.6.4 |
| arubanetworks/edgeconnect_sd-wan_orchestrator | all versions | — |
| hpe/edgeconnect_operating_system | ≥ 9.4.0.0, < 9.4.9.0 | 9.4.9.0 |
| hpe/edgeconnect_operating_system | ≥ 9.5.0.0, < 9.5.9.0 | 9.5.9.0 |
| hpe/edgeconnect_operating_system | ≥ 9.6.0.0, < 9.6.4.0 | 9.6.4.0 |
| hpe/edgeconnect_operating_system | all versions | — |