CVE-2026-63456

The 9.8 CVSS and 0.00428 EPSS on this HPE SD-WAN orchestrator vulnerability tell opposite stories — and that gap is an analytical trap. EPSS models mass-exploitation likelihood against internet-facing exposure. An HPE SD-WAN orchestration platform isn't being scanned broadly or hit by drive-by exploits, so the model correctly registers low probability. But low probability does not equal low priority when the architecture creates a single point of failure. SD-WAN orchestrators are not typical application servers. They are centralized controllers that make routing decisions for entire branch networks simultaneously. A vulnerability allowing unauthenticated attackers to bypass authentication on the orchestrator doesn't compromise one system — it compromises every branch that system governs. One foothold yields control over your entire Wide Area Network topology. The blast radius isn't additive across vulnerable instances; it's multiplicative across all connected branches. Interrogate what 'view and modify potentially sensitive information' actually means here. SD-WAN orchestrators store network diagrams, branch configurations, security policies, and VPN credentials. An attacker who can read and write these configurations has the blueprint to your network infrastructure and the keys to impersonate any branch. This is infrastructure takeover, not data theft. The key questions: What percentage of deployments expose the orchestrator management interface directly to the internet versus through a VPN or zero-trust gateway? Does your architecture assume the orchestrator itself is a trusted security boundary? If you answered yes to both, this deserves immediate attention despite the low EPSS. Even organizations with 'contained' deployments should verify which authentication middleware actually protects the endpoints being used — this class of vulnerability often surfaces from authentication logic written years ago that was never audited against the current threat model. The 'bypass web authentication' phrasing in CVE descriptions has historically correlated with authentication bypasses in Cisco Prime Infrastructure, Aruba AirWave, and VMware vCenter — all of which were exploited in targeted attacks after initial deprioritization. Low EPSS reflects mass scanning; it says nothing about targeted exploitation by actors who specifically profile SD-WAN infrastructure.

Reviewed through automated stages and approved by a human before publication.