A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary multi-factor authentication, thereby compromising the integrity of secured access to the system.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aruba Ecos | — | To fully patch the vulnerabilities described above, HPE Aruba Networking
recommends upgrading your EdgeConnect Orchestrator to one of following
versions (as applicable):
- EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above
- EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above
- EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above
HPE Aruba Networking does not evaluate or patch software branches
that have reached their End of Maintenance (EoM) milestone.
Supported EdgeConnect SD-WAN Orchestrator software branches as
of the publication date of this advisory are:
- EdgeConnect SD-WAN Orchestrator 9.6.x
- EdgeConnect SD-WAN Orchestrator 9.5.x
- EdgeConnect SD-WAN Orchestrator 9.4.x
Software versions with resolution/fixes for the vulnerabilities covered
above, can be downloaded from the HPE Networking Support Portal.
https://networkingsupport.hpe.com/home/
HPE Aruba Networking does not evaluate or patch software
branches that have reached their End of Maintenance (EoM)
milestone. For more information about Aruba's End of Support
policy please visit: https://www.hpe.com/psnow/doc/a00143052enw | Jan 15, 2026 | Jan 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub