CVE-2026-63456 describes multiple vulnerabilities in the REST API interface of Hewlett Packard Enterprise's EdgeConnect SD-WAN Orchestrator. These flaws allow an unauthenticated remote attacker to bypass authentication mechanisms and gain unauthorized access to system functions. Successful exploitation could result in the attacker viewing and modifying sensitive data on the affected system. The vulnerabilities affect specific versions 9.6.2.00000 and 9.6.3.00000. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

An unauthenticated remote attacker can bypass authentication controls on the REST API, potentially leading to unauthorized access to sensitive information and modification of system data. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the REST API interface to trusted sources only and monitor for suspicious activity related to API access.