External risk intelligence

HPE Networking SD-WAN Orchestrator REST API Authentication Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-63455

The vulnerability exists in the REST API interface of an SD-WAN Orchestrator, which is a network management appliance designed to be reachable for administrative functions. Such systems are commonly deployed in edge or gateway roles and are often exposed or accessible to facilitate orchestration across network environments.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in HPE Networking SD-WAN Orchestrator's REST API, potentially allowing unauthenticated attackers to bypass security controls and access or alter sensitive system information.

Attackers can bypass logins to access systems.
Critical security flaws in network management tools.
Confirm exposure of network management systems.

Attack Path

How an attacker could exploit the issue

An attacker could target the HPE Networking SD-WAN Orchestrator's REST API to bypass its login controls. Once authenticated, the attacker could then access or alter sensitive system data.

No authentication required for initial access.
Triggered via the REST API interface.
Risk of sensitive data exposure or modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to bypass web authentication and access system functions within HPE Networking SD-WAN Orchestrator. This could lead to an attacker viewing and modifying sensitive information on the target system.

System information at risk.
Unauthenticated remote access.
Unauthorized data viewing and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in HPE Networking SD-WAN Orchestrator's REST API requires immediate attention from the platform and network/security teams, in coordination with the vendor-management team. The first step is to identify all instances of the affected technology, assess their exposure and business criticality, and determine the accountable system owners to prioritize remediation efforts.

Platform and Network/Security teams own.
Verify external reachability and impact.
Plan coordinated vendor-assisted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is HPE Networking SD-WAN Orchestrator?

It is a central management platform for software-defined wide area networks. Organizations use it to configure, monitor, and manage the connectivity, security, and traffic policies of distributed network branches from a single point of control.

What does this CVE-2026-63455 vulnerability actually mean?

This is an authentication bypass issue. In technical terms, it allows a remote user to skip the required login process when interacting with the system's REST API. Because the API acts as the management interface, bypassing authentication lets an attacker perform sensitive system actions without proving who they are.

How is this vulnerability triggered in the API?

The flaw is triggered by sending specially crafted requests directly to the REST API interface. Importantly, this does not require any prior user credentials or session tokens; the system fails to enforce security checks before executing the requested commands. Regular, authenticated management traffic remains a valid use of the system and does not inherently trigger this vulnerability.

Is my HPE Networking SD-WAN Orchestrator at risk?

According to Halo Surface Signal, these appliances are often placed in edge or gateway roles to manage network traffic, making them high-value targets. If your instance is reachable over the network—particularly if it is exposed to the internet to facilitate remote orchestration—the risk is higher, as an attacker does not need local network access to exploit this.

What should I do first to address this?

Begin by creating an inventory of all orchestrator instances within your environment. Once identified, coordinate with your network and security teams to verify where these systems are reachable on the network. Prioritize restricting access to these interfaces while you work with the vendor to implement the necessary updates or security patches.

References

support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05100en_us&docLo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.