EUVD-2026-84674
GHSA-m7jf-8pvj-2r6w
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable web interface (AV:N/AC:L) but requires high-privilege authenticated access (PR:H); command runs as root giving full C:H/I:H/A:H on the same host (S:U).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
3DescriptionCVE.org
Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
AnalysisAI
Command execution in the HPE Analytics and Location Engine (ALE) web interface allows remote, high-privilege authenticated users to run arbitrary commands as root on the underlying host, resulting in complete compromise of the appliance. The flaw is network-reachable with low attack complexity and requires no user interaction, but the attacker must already hold valid administrative/high-privilege credentials for the ALE web interface (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH), which materially narrows the realistic attack surface to organizations running the ALE platform with its web interface exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated, high-privilege account on the HPE Analytics and Location Engine (ALE) web interface (CVSS PR:H) reachable over the network (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH) describes a network-reachable but high-privilege command execution flaw in the HPE Analytics and Location Engine (ALE) web interface, yielding full C:H/I:H/A:H impact as root. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: HPE has published security guidance at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US, and administrators should apply the ALE update identified there as the primary fix; no exact fixed version number is specified in the available input data, so confirm the target release against the HPE bulletin rather than assuming a version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all HPE ALE web interfaces, restrict network access to trusted management zones, and enforce multi-factor authentication for every administrative account. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
Unauthenticated remote write access to the file system with elevated privileges in HPE Analytics and Location Engine (AL
Information disclosure in HPE ALE management interface allows unauthenticated remote attackers to retrieve sensitive sit
Unauthenticated data injection in HPE's Analytics and Location Engine (ALE) lets any attacker who can reach the ALE serv
Unauthenticated remote access to an HPE Analytics and Location Engine (ALE) deployment can yield limited sensitive-infor
Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrat
Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first estab
Unauthenticated, network-reachable attacks against HPE Aruba Analytics and Location Engine (ALE) can degrade or knock ou
Unauthenticated information disclosure in the HPE Aruba Analytics and Location Engine (ALE) API allows any remote attack
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today