← Search results
CVE-LINKED INVENTORY27 SECURITY RECORDS
Hewlett Packard Enterprise (HPE)
EdgeConnect SD-WAN Orchestrator
Affected and fixed version statements observed in the public BlackTree CVE catalogue. These statements describe vulnerability scope, not publisher support entitlement.
This identity is present in BlackTree CVE records, but no product-specific publisher support or retirement history is currently registered in Lifecycle.
A missing support date does not mean the product is supported. CVE publication dates and affected-version ranges must not be interpreted as EOL dates.
CVE-observed version history
| CVE | Published | Affected versions | Fixed version information | Publisher evidence |
|---|---|---|---|---|
| CVE-2026-63456 | 4 Aug 2026 | 9.6.2.00000 ≤ 9.6.2.40208; 9.6.3.00000 ≤ 9.6.3.40137 | In order to address the vulnerabilities described above for the affected software branches, HPE Aruba Networking recommends upgrading the software to one of the following versions (as applicable): - SD-WAN Orchestrator 9.7.0.x: 9.7.0.43264 and above - SD-WAN Orchestrator 9.6.3.x: 9.6.3.40140 and above - SD-WAN Orchestrator 9.6.2.x: 9.6.2.40210 and above Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ Product software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Support (EoST) milestone. For more information about HPE Aruba Networking EdgeConnect Product Lifecycle Policy, please visit: https://arubanetworking.hpe.com/techdocs/sdwan-PDFs/docs/eula/EC_LifecyclePolicy_latest.pdf | Update reference ↗ |
| CVE-2026-63455 | 4 Aug 2026 | 9.6.2.00000 ≤ 9.6.2.40208; 9.6.3.00000 ≤ 9.6.3.40137 | In order to address the vulnerabilities described above for the affected software branches, HPE Aruba Networking recommends upgrading the software to one of the following versions (as applicable): - SD-WAN Orchestrator 9.7.0.x: 9.7.0.43264 and above - SD-WAN Orchestrator 9.6.3.x: 9.6.3.40140 and above - SD-WAN Orchestrator 9.6.2.x: 9.6.2.40210 and above Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ Product software versions that have reached End of Maintenance (EoM) are presumed to be affected by the vulnerabilities unless explicitly stated otherwise, and are not covered by this security advisory. HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Support (EoST) milestone. For more information about HPE Aruba Networking EdgeConnect Product Lifecycle Policy, please visit: https://arubanetworking.hpe.com/techdocs/sdwan-PDFs/docs/eula/EC_LifecyclePolicy_latest.pdf | Update reference ↗ |
| CVE-2025-37181 | 14 Jan 2026 | 9.5.0 ≤ 9.6.0; 9.4.0 ≤ 9.4.4 | To fully patch the vulnerabilities described above, HPE Aruba Networking recommends upgrading your EdgeConnect Orchestrator to one of following versions (as applicable): - EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above - EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above - EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. Supported EdgeConnect SD-WAN Orchestrator software branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.6.x - EdgeConnect SD-WAN Orchestrator 9.5.x - EdgeConnect SD-WAN Orchestrator 9.4.x Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. For more information about Aruba's End of Support policy please visit: https://www.hpe.com/psnow/doc/a00143052enw | Update reference ↗ |
| CVE-2025-37185 | 14 Jan 2026 | 9.5.0 ≤ 9.6.0; 9.4.0 ≤ 9.4.4 | To fully patch the vulnerabilities described above, HPE Aruba Networking recommends upgrading your EdgeConnect Orchestrator to one of following versions (as applicable): - EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above - EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above - EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. Supported EdgeConnect SD-WAN Orchestrator software branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.6.x - EdgeConnect SD-WAN Orchestrator 9.5.x - EdgeConnect SD-WAN Orchestrator 9.4.x Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. For more information about Aruba's End of Support policy please visit: https://www.hpe.com/psnow/doc/a00143052enw | Update reference ↗ |
| CVE-2025-37184 | 14 Jan 2026 | 9.5.0 ≤ 9.6.0; 9.4.0 ≤ 9.4.4 | To fully patch the vulnerabilities described above, HPE Aruba Networking recommends upgrading your EdgeConnect Orchestrator to one of following versions (as applicable): - EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above - EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above - EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. Supported EdgeConnect SD-WAN Orchestrator software branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.6.x - EdgeConnect SD-WAN Orchestrator 9.5.x - EdgeConnect SD-WAN Orchestrator 9.4.x Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. For more information about Aruba's End of Support policy please visit: https://www.hpe.com/psnow/doc/a00143052enw | Update reference ↗ |
| CVE-2025-37183 | 14 Jan 2026 | 9.5.0 ≤ 9.6.0; 9.4.0 ≤ 9.4.4 | To fully patch the vulnerabilities described above, HPE Aruba Networking recommends upgrading your EdgeConnect Orchestrator to one of following versions (as applicable): - EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above - EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above - EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. Supported EdgeConnect SD-WAN Orchestrator software branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.6.x - EdgeConnect SD-WAN Orchestrator 9.5.x - EdgeConnect SD-WAN Orchestrator 9.4.x Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. For more information about Aruba's End of Support policy please visit: https://www.hpe.com/psnow/doc/a00143052enw | Update reference ↗ |
| CVE-2025-37182 | 14 Jan 2026 | 9.5.0 ≤ 9.6.0; 9.4.0 ≤ 9.4.4 | To fully patch the vulnerabilities described above, HPE Aruba Networking recommends upgrading your EdgeConnect Orchestrator to one of following versions (as applicable): - EdgeConnect SD-WAN Orchestrator 9.6.x : 9.6.1 and above - EdgeConnect SD-WAN Orchestrator 9.5.x : 9.5.6 and above - EdgeConnect SD-WAN Orchestrator 9.4.x : 9.4.8 and above HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. Supported EdgeConnect SD-WAN Orchestrator software branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.6.x - EdgeConnect SD-WAN Orchestrator 9.5.x - EdgeConnect SD-WAN Orchestrator 9.4.x Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. https://networkingsupport.hpe.com/home/ HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. For more information about Aruba's End of Support policy please visit: https://www.hpe.com/psnow/doc/a00143052enw | Update reference ↗ |
| CVE-2023-37440 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.*; Orchestrator 9.1.x ≤ <=9.1.* | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37439 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.5; Orchestrator 9.1.x ≤ <=9.1.7 | HPE Aruba Networking has patched this particular vulnerability in the following branches and versions of Orchestrator: - Orchestrator 9.3.x: Orchestrator 9.3.0 (all builds) and above - Orchestrator 9.2.x: Orchestrator 9.2.3 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.6 (all builds) and above | Update reference ↗ |
| CVE-2023-37438 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.*; Orchestrator 9.1.x ≤ <=9.1.* | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37437 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.*; Orchestrator 9.1.x ≤ <=9.1.* | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37436 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.*; Orchestrator 9.1.x ≤ <=9.1.* | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37435 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.*; Orchestrator 9.1.x ≤ <=9.1.* | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37434 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.*; Orchestrator 9.1.x ≤ <=9.1.* | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37433 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.*; Orchestrator 9.1.x ≤ <=9.1.* | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37432 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.*; Orchestrator 9.1.x ≤ <=9.1.* | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37431 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.*; Orchestrator 9.1.x ≤ <=9.1.* | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37430 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.*; Orchestrator 9.1.x ≤ <=9.1.* | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37429 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.*; Orchestrator 9.1.x ≤ <=9.1.* | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37428 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.5; Orchestrator 9.1.x ≤ <=9.1.7 | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37427 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.5; Orchestrator 9.1.x ≤ <=9.1.7 | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37426 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.5; Orchestrator 9.1.x ≤ <=9.1.7 | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37425 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.5; Orchestrator 9.1.x ≤ <=9.1.7 | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37424 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.5; Orchestrator 9.1.x ≤ <=9.1.7 | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37423 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.5; Orchestrator 9.1.x ≤ <=9.1.7 | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37422 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.5; Orchestrator 9.1.x ≤ <=9.1.7 | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
| CVE-2023-37421 | 22 Aug 2023 | Orchestrator 9.3.x ≤ <=9.3.0; Orchestrator 9.2.x ≤ <=9.2.5; Orchestrator 9.1.x ≤ <=9.1.7 | PLEASE NOTE - To fully patch the vulnerabilities disclosed above, including lower severity authenticated vulnerabilities that require existing administrative access, customers must upgrade to the following branch and version: - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) For those who choose to implement workarounds and other security controls documented in the details sections above, all vulnerabilities with a CVSS score of 7.0 and above are addressed by upgrading to the following branches and versions of EdgeConnect SD-WAN Orchestrator: - EdgeConnect SD-WAN Orchestrator (self-hosted, on-premises) - EdgeConnect SD-WAN Orchestrator (self-hosted, public cloud IaaS) - EdgeConnect SD-WAN Orchestrator-as-a-Service - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - EdgeConnect SD-WAN Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.3.x: Orchestrator 9.3.1 (all builds) and above (expected to be available end of September 2023) - Orchestrator 9.2.x: Orchestrator 9.2.6 (all builds) and above - Orchestrator 9.1.x: Orchestrator 9.1.8 (all builds) and above - EdgeConnect SD-WAN Orchestrator-SP Tenant Orchestrators - Service providers must upgrade all tenants to a patched version listed above. HPE Aruba Networking does not evaluate or patch product branches that have reached their End of Maintenance (EoM) milestone. Supported branches as of the publication date of this advisory are: - EdgeConnect SD-WAN Orchestrator 9.3.x - EdgeConnect SD-WAN Orchestrator 9.2.x - EdgeConnect SD-WAN Orchestrator 9.1.x For more information about Aruba's End of Support policy visit: https://www.arubanetworks.com/support-services/end-of-life/ | Update reference ↗ |
How this record is maintained
The CVE inventory is reconciled automatically from cve.blacktree.nl. Exact identity matches link to existing Lifecycle product or package histories. Unmatched products stay in a prioritised publisher-source research queue, and Lifecycle marks the date gap instead of inferring a support boundary from vulnerability data.