CVE-2025-37184
EUVD-2026-245814.01.2026, 17:16
A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary multi-factor authentication, thereby compromising the integrity of secured access to the system.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| arubanetworks | edgeconnect_sd-wan_orchestrator | 9.2.0 ≤ 𝑥 ≤ 9.2.10 |
| arubanetworks | edgeconnect_sd-wan_orchestrator | 9.3.0 ≤ 𝑥 < 9.3.6 |
| arubanetworks | edgeconnect_sd-wan_orchestrator | 9.4.0 ≤ 𝑥 < 9.4.3 |
| arubanetworks | edgeconnect_sd-wan_orchestrator | 9.5.0 ≤ 𝑥 < 9.5.6 |
| arubanetworks | edgeconnect_sd-wan_orchestrator | 9.6.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration