{"api_version":"v1","generated_at":"2026-10-10T02:45:00+00:00","product":{"cve_count":27,"evidence_gap_note":"This identity is present in BlackTree CVE records, but no product-specific publisher support or retirement history is currently registered in Lifecycle.","id":"security:cve-hewlett-packard-enterprise-hpe-edgeconnect-sd-wan-orchestrator-dfeecefb466c","lifecycle_state":"evidence_gap","linked_lifecycle_url":null,"name":"EdgeConnect SD-WAN Orchestrator","next_cursor":null,"observations":[{"affected":"9.6.2.00000 \u2264 9.6.2.40208; 9.6.3.00000 \u2264 9.6.3.40137","affected_versions_present":true,"cve_id":"CVE-2026-63456","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-63456","fixed":"In order to address the vulnerabilities described above for the affected software branches, HPE Aruba Networking recommends upgrading the software to one of the following versions (as applicable): - SD-WAN Orchestrator 9.7.0.x: 9.7.0.43264 and above - SD-WAN Orchestrator 9.6.3.x: 9.6.3.40140 and above - SD-WAN Orchestrator 9.6.2.x: 9.6.2.40210 and above Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ Product software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Support (EoST) milestone. For more information about HPE Aruba Networking EdgeConnect Product Lifecycle Policy, please visit: https://arubanetworking.hpe.com/techdocs/sdwan-PDFs/docs/eula/EC_LifecyclePolicy_latest.pdf","last_modified":"2026-08-04T17:27:47.723Z","patch_url":"https://csaf.arubanetworking.hpe.com/","primary_source":"","published":"2026-08-04T16:41:00.097Z"},{"affected":"9.6.2.00000 \u2264 9.6.2.40208; 9.6.3.00000 \u2264 9.6.3.40137","affected_versions_present":true,"cve_id":"CVE-2026-63455","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-63455","fixed":"In order to address the vulnerabilities described above for the affected software branches, HPE Aruba Networking recommends upgrading the software to one of the following versions (as applicable): - SD-WAN Orchestrator 9.7.0.x: 9.7.0.43264 and above - SD-WAN Orchestrator 9.6.3.x: 9.6.3.40140 and above - SD-WAN Orchestrator 9.6.2.x: 9.6.2.40210 and above Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ Product software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Support (EoST) milestone. For more information about HPE Aruba Networking EdgeConnect Product Lifecycle Policy, please visit: https://arubanetworking.hpe.com/techdocs/sdwan-PDFs/docs/eula/EC_LifecyclePolicy_latest.pdf","last_modified":"2026-08-04T17:33:01.785Z","patch_url":"https://csaf.arubanetworking.hpe.com/","primary_source":"","published":"2026-08-04T16:40:50.618Z"},{"affected":"9.5.0 \u2264 9.6.0; 9.4.0 \u2264 9.4.4","affected_versions_present":true,"cve_id":"CVE-2025-37181","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-37181","fixed":"To fully patch the vulnerabilities described above, HPE Aruba Networking recommends upgrading your EdgeConnect Orchestrator to one of following versions (as applicable): - EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above - EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above - EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. Supported EdgeConnect SD-WAN Orchestrator software branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.6.x - EdgeConnect SD-WAN Orchestrator 9.5.x - EdgeConnect SD-WAN Orchestrator 9.4.x Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. For more information about Aruba's End of Support policy please visit: https://www.hpe.com/psnow/doc/a00143052enw","last_modified":"2026-01-14T16:44:42.431Z","patch_url":"https://csaf.arubanetworking.hpe.com/","primary_source":"","published":"2026-01-14T16:26:00.858Z"},{"affected":"9.5.0 \u2264 9.6.0; 9.4.0 \u2264 9.4.4","affected_versions_present":true,"cve_id":"CVE-2025-37185","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-37185","fixed":"To fully patch the vulnerabilities described above, HPE Aruba Networking recommends upgrading your EdgeConnect Orchestrator to one of following versions (as applicable): - EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above - EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above - EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. Supported EdgeConnect SD-WAN Orchestrator software branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.6.x - EdgeConnect SD-WAN Orchestrator 9.5.x - EdgeConnect SD-WAN Orchestrator 9.4.x Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. For more information about Aruba's End of Support policy please visit: https://www.hpe.com/psnow/doc/a00143052enw","last_modified":"2026-01-14T16:47:13.535Z","patch_url":"https://csaf.arubanetworking.hpe.com/","primary_source":"","published":"2026-01-14T16:20:30.732Z"},{"affected":"9.5.0 \u2264 9.6.0; 9.4.0 \u2264 9.4.4","affected_versions_present":true,"cve_id":"CVE-2025-37184","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-37184","fixed":"To fully patch the vulnerabilities described above, HPE Aruba Networking recommends upgrading your EdgeConnect Orchestrator to one of following versions (as applicable): - EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above - EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above - EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. Supported EdgeConnect SD-WAN Orchestrator software branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.6.x - EdgeConnect SD-WAN Orchestrator 9.5.x - EdgeConnect SD-WAN Orchestrator 9.4.x Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. For more information about Aruba's End of Support policy please visit: https://www.hpe.com/psnow/doc/a00143052enw","last_modified":"2026-03-03T17:48:58.628Z","patch_url":"https://csaf.arubanetworking.hpe.com/","primary_source":"","published":"2026-01-14T16:19:45.879Z"},{"affected":"9.5.0 \u2264 9.6.0; 9.4.0 \u2264 9.4.4","affected_versions_present":true,"cve_id":"CVE-2025-37183","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-37183","fixed":"To fully patch the vulnerabilities described above, HPE Aruba Networking recommends upgrading your EdgeConnect Orchestrator to one of following versions (as applicable): - EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above - EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above - EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. Supported EdgeConnect SD-WAN Orchestrator software branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.6.x - EdgeConnect SD-WAN Orchestrator 9.5.x - EdgeConnect SD-WAN Orchestrator 9.4.x Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. For more information about Aruba's End of Support policy please visit: https://www.hpe.com/psnow/doc/a00143052enw","last_modified":"2026-01-14T16:44:25.188Z","patch_url":"https://csaf.arubanetworking.hpe.com/","primary_source":"","published":"2026-01-14T16:18:14.058Z"},{"affected":"9.5.0 \u2264 9.6.0; 9.4.0 \u2264 9.4.4","affected_versions_present":true,"cve_id":"CVE-2025-37182","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-37182","fixed":"To fully patch the vulnerabilities described above, HPE Aruba Networking recommends upgrading your EdgeConnect Orchestrator to one of following versions (as applicable): - EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above - EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above - EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. Supported EdgeConnect SD-WAN Orchestrator software branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.6.x - EdgeConnect SD-WAN Orchestrator 9.5.x - EdgeConnect SD-WAN Orchestrator 9.4.x Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. For more information about Aruba's End of Support policy please visit: https://www.hpe.com/psnow/doc/a00143052enw","last_modified":"2026-01-14T16:40:21.747Z","patch_url":"https://csaf.arubanetworking.hpe.com/","primary_source":"","published":"2026-01-14T16:17:12.170Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.*; Orchestrator 9.1.x \u2264 <=9.1.*","affected_versions_present":true,"cve_id":"CVE-2023-37440","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37440","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-29T19:17:30.370Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:10:43.522Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.5; Orchestrator 9.1.x \u2264 <=9.1.7","affected_versions_present":true,"cve_id":"CVE-2023-37439","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37439","fixed":"HPE Aruba Networking has patched this particular vulnerability in the following branches and versions of Orchestrator: - Orchestrator 9.3.x: Orchestrator 9.3.0 (all builds) and above - Orchestrator 9.2.x: Orchestrator 9.2.3 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.6 (all builds) and above","last_modified":"2024-10-29T19:16:16.550Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:09:38.208Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.*; Orchestrator 9.1.x \u2264 <=9.1.*","affected_versions_present":true,"cve_id":"CVE-2023-37438","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37438","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T14:16:57.194Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:08:32.465Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.*; Orchestrator 9.1.x \u2264 <=9.1.*","affected_versions_present":true,"cve_id":"CVE-2023-37437","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37437","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T14:21:24.724Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:08:28.560Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.*; Orchestrator 9.1.x \u2264 <=9.1.*","affected_versions_present":true,"cve_id":"CVE-2023-37436","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37436","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-04T15:48:23.055Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:08:25.585Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.*; Orchestrator 9.1.x \u2264 <=9.1.*","affected_versions_present":true,"cve_id":"CVE-2023-37435","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37435","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-04T15:51:02.673Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:08:21.918Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.*; Orchestrator 9.1.x \u2264 <=9.1.*","affected_versions_present":true,"cve_id":"CVE-2023-37434","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37434","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-04T15:56:14.997Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:08:17.910Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.*; Orchestrator 9.1.x \u2264 <=9.1.*","affected_versions_present":true,"cve_id":"CVE-2023-37433","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37433","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-04T15:59:29.442Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:08:11.685Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.*; Orchestrator 9.1.x \u2264 <=9.1.*","affected_versions_present":true,"cve_id":"CVE-2023-37432","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37432","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-04T16:03:15.265Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:08:07.446Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.*; Orchestrator 9.1.x \u2264 <=9.1.*","affected_versions_present":true,"cve_id":"CVE-2023-37431","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37431","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T14:25:32.604Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:08:04.472Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.*; Orchestrator 9.1.x \u2264 <=9.1.*","affected_versions_present":true,"cve_id":"CVE-2023-37430","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37430","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T14:41:00.162Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:08:01.717Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.*; Orchestrator 9.1.x \u2264 <=9.1.*","affected_versions_present":true,"cve_id":"CVE-2023-37429","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37429","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T14:45:14.356Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:07:58.022Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.5; Orchestrator 9.1.x \u2264 <=9.1.7","affected_versions_present":true,"cve_id":"CVE-2023-37428","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37428","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T14:48:07.190Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:04:50.122Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.5; Orchestrator 9.1.x \u2264 <=9.1.7","affected_versions_present":true,"cve_id":"CVE-2023-37427","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37427","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T14:51:40.904Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:03:52.781Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.5; Orchestrator 9.1.x \u2264 <=9.1.7","affected_versions_present":true,"cve_id":"CVE-2023-37426","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37426","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T15:04:38.699Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:02:22.824Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.5; Orchestrator 9.1.x \u2264 <=9.1.7","affected_versions_present":true,"cve_id":"CVE-2023-37425","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37425","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T15:15:23.972Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T18:01:03.060Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.5; Orchestrator 9.1.x \u2264 <=9.1.7","affected_versions_present":true,"cve_id":"CVE-2023-37424","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37424","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T15:20:46.719Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T17:59:26.532Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.5; Orchestrator 9.1.x \u2264 <=9.1.7","affected_versions_present":true,"cve_id":"CVE-2023-37423","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37423","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T15:21:54.991Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T17:57:30.109Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.5; Orchestrator 9.1.x \u2264 <=9.1.7","affected_versions_present":true,"cve_id":"CVE-2023-37422","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37422","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T15:22:54.945Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T17:57:26.526Z"},{"affected":"Orchestrator 9.3.x \u2264 <=9.3.0; Orchestrator 9.2.x \u2264 <=9.2.5; Orchestrator 9.1.x \u2264 <=9.1.7","affected_versions_present":true,"cve_id":"CVE-2023-37421","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-37421","fixed":"PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/","last_modified":"2024-10-03T19:35:36.448Z","patch_url":"https://csaf.arubanetworking.hpe.com/2023/hpe_aruba_networking_-_2023-012.json","primary_source":"","published":"2023-08-22T17:57:19.127Z"}],"source_generated_at":"2026-10-09T06:17:25.511Z","vendor":"Hewlett Packard Enterprise (HPE)"}}