Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attacks against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface and thereby make unauthorized arbitrary configuration changes to the host.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aruba Ecos | — | To fully patch the vulnerabilities described above, HPE Aruba Networking
recommends upgrading your EdgeConnect Orchestrator to one of following
versions (as applicable):
- EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above
- EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above
- EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above
HPE Aruba Networking does not evaluate or patch software branches
that have reached their End of Maintenance (EoM) milestone.
Supported EdgeConnect SD-WAN Orchestrator software branches as
of the publication date of this advisory are:
- EdgeConnect SD-WAN Orchestrator 9.6.x
- EdgeConnect SD-WAN Orchestrator 9.5.x
- EdgeConnect SD-WAN Orchestrator 9.4.x
Software versions with resolution/fixes for the vulnerabilities covered
above, can be downloaded from the HPE Networking Support Portal.
https://networkingsupport.hpe.com/home/
HPE Aruba Networking does not evaluate or patch software
branches that have reached their End of Maintenance (EoM)
milestone. For more information about Aruba's End of Support
policy please visit: https://www.hpe.com/psnow/doc/a00143052enw | Jan 15, 2026 | Jan 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub