CVE-2026-63456: Authentication bypass via spoofed HTTP headers Orchestrator REST API
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63456?
CVE-2026-63456 has a severity rating of critical with a score of 9.8.
How do I fix CVE-2026-63456?
To fix CVE-2026-63456, apply the latest security patch released for HPE Networking SD-WAN Orchestrator.
What types of attacks are possible with CVE-2026-63456?
CVE-2026-63456 may allow unauthenticated attackers to bypass web authentication and access sensitive system functions.
Who is affected by CVE-2026-63456?
Users of the HPE Networking SD-WAN Orchestrator REST API are affected by CVE-2026-63456.
What can attackers do if they exploit CVE-2026-63456?
If exploited, attackers can view and modify sensitive information within the system.