Retrospective for 2026-08-05, compiled on 27 October 2026. The date identifies the day being analysed; source publication and revision dates are recorded below.
What this advisory changes in your environment
The starting point is CERTFR-2026-AVI-0969, published on 2026-08-05. Its scope includes EdgeConnect SD-WAN Orchestrator. Reported consequences are data integrity compromise, security control bypass, loss of confidentiality. These statements apply to the advisory’s scope; they do not assign every consequence to every product or CVE.
This case focuses on EdgeConnect SD-WAN Orchestrator. Locate that edition in live installations, deployment images and actual dependencies, rather than treating every product from HPE Aruba Networking as equivalent.
Products and versions to examine
- Reference
- CERTFR-2026-AVI-0969
- Source first published
- 2026-08-05
- Latest source revision available for this day
- 2026-08-05
- Named components
- EdgeConnect SD-WAN Orchestrator
- CVE identifiers
- CVE-2026-63456, CVE-2026-63455
| Component | Published condition |
|---|---|
| EdgeConnect SD-WAN Orchestrator | 9.7.0.x : < 9.7.0.43264 |
| EdgeConnect SD-WAN Orchestrator | 9.6.3.x : < 9.6.3.40140 |
| EdgeConnect SD-WAN Orchestrator | 9.6.2.x : < 9.6.2.40210 |
For EdgeConnect SD-WAN Orchestrator, the published condition is “9.7.0.x : < 9.7.0.43264”. Compare the version actually loaded with that condition within its own release branch. A fix installed on another edition of EdgeConnect SD-WAN Orchestrator does not close this case.
Mechanism and prerequisites
A security bypass challenges a trust boundary. Verify server-side authorisation decisions and alternative paths; hiding an interface is not an access restriction.
The primary record CVE-2026-63456, published by hpe, covers EdgeConnect SD-WAN Orchestrator. The retained revision is dated 2026-08-04. Its scope is presented separately from the integrations and product groupings in CERTFR-2026-AVI-0969.
The published metric for CVE-2026-63456 is CVSS 3.1, 9.8/10. The vector below describes technical prerequisites; it does not measure attack frequency or the likelihood that your deployment is compromised.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- network
- Prior privileges
- none
- User interaction
- none
- Complexity
- low
Choose the appropriate intervention
- Locate EdgeConnect SD-WAN Orchestrator instances, running releases and service owners. Record condition 9.7.0.x : < 9.7.0.43264 in the ticket alongside reference CERTFR-2026-AVI-0969.
- Compare the installed branch with the vendor’s EdgeConnect SD-WAN Orchestrator release notes. Prepare the package for that branch and a dependent-service test, retaining the pre-change state.
- After changing EdgeConnect SD-WAN Orchestrator, capture the loaded version again and verify the workflow below. Any exception needs an owner, an exposure-reduction measure and an expiry date.
Verify the fix in a real workflow
Validation scenario to adapt for EdgeConnect SD-WAN Orchestrator: For EdgeConnect SD-WAN Orchestrator, test an authorised business flow from each zone reaching the service and confirm management restrictions. If a redundant pair exists, verify both nodes and rule persistence after failover during a planned maintenance window. This is a proposed defensive check, not a claim that testing was performed against third-party systems.
Limit of case CERTFR-2026-AVI-0969: this analysis replaces neither vendor prerequisites nor investigation of your logs. Only documented versions are reproduced; no attack date or victim is invented.
Questions specific to this case
Which condition should be checked for EdgeConnect SD-WAN Orchestrator?
Advisory CERTFR-2026-AVI-0969 states: EdgeConnect SD-WAN Orchestrator — 9.7.0.x : < 9.7.0.43264. Check the edition and running release; do not extend the published boundary to branches absent from the advisory.
Which prerequisites does record CVE-2026-63456 specify?
For CVE-2026-63456, the published vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Verify those conditions on EdgeConnect SD-WAN Orchestrator before applying them to an integration named in CERTFR-2026-AVI-0969.
Sources and related reading
- CERT-FR · CERTFR-2026-AVI-0969
- Vendor and remediation · csaf.arubanetworking.hpe.com
- CVE-2026-63456 · CNA
Practical guide : Software inventory: prepare for end of support
Explore the decision addressed in this case
Complete source advisory inventory
The article table may be an extract. These lists contain every affected-system entry and CVE in the specified advisory revision. They are not an inventory of your assets and do not map every CVE to every product.
Official source · CERTFR-2026-AVI-0969
Advisory revision : · Checked on :
Affected systems · 3
Original French wording is retained to avoid ambiguous translations of version conditions.
- EdgeConnect SD-WAN Orchestrator versions 9.7.0.x antérieures à 9.7.0.43264
- EdgeConnect SD-WAN Orchestrator versions 9.6.3.x antérieures à 9.6.3.40140
- EdgeConnect SD-WAN Orchestrator versions 9.6.2.x antérieures à 9.6.2.40210