CVE-2026-63455 describes multiple security flaws in the REST API of HPE EdgeConnect SD-WAN Orchestrator versions 9.6.2.00000 and 9.6.3.00000. These vulnerabilities allow unauthenticated remote attackers to bypass authentication controls and gain unauthorized access to system functions, potentially exposing and allowing modification of sensitive data. The CVSS 3.1 base score is 9.8, indicating critical impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. No vendor advisory or patch information is currently available.

Successful exploitation enables unauthenticated attackers to bypass authentication mechanisms and access sensitive system functions, leading to potential disclosure and modification of sensitive information and disruption of system availability. The critical CVSS score reflects the high risk of compromise without any required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the REST API interface and monitor for suspicious activity. Follow vendor communications for updates on patches or mitigations.