EUVD-2026-84676
GHSA-wg54-xg54-v973
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Unauthenticated network attack (AV:N/AC:L/PR:N/UI:N); I add C:L to reflect the described 'unauthorized access to sensitive information' alongside the vendor's A:L DoS, with no integrity impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted input or leveraging improper security configurations. Successful exploitation could result in a denial of service condition or unauthorized access to sensitive information.
AnalysisAI
Unauthenticated, network-reachable attacks against HPE Aruba Analytics and Location Engine (ALE) can degrade or knock out the service and may expose sensitive location/analytics data, with HPE reporting multiple issues bundled under CVE-2026-76716. Per the scored vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, no credentials and no user interaction are required, but the quantified impact is limited to low confidentiality and low availability, so this is a moderate rather than urgent priority. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to an HPE Aruba Analytics and Location Engine (ALE) instance and either sending specially crafted input to its exposed service or the presence of an 'improper security configuration' as noted in the description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, not urgent, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed version is enumerated in the available data, so remediation must be driven by the HPE Security Bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US, which is the authoritative source for the patched ALE build and any product-specific hardening notes; confirm the target release against that advisory before scheduling an upgrade, and apply it on a maintenance window since ALE upgrades typically interrupt location analytics and downstream integrations. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
Unauthenticated remote write access to the file system with elevated privileges in HPE Analytics and Location Engine (AL
Information disclosure in HPE ALE management interface allows unauthenticated remote attackers to retrieve sensitive sit
Unauthenticated data injection in HPE's Analytics and Location Engine (ALE) lets any attacker who can reach the ALE serv
Unauthenticated remote access to an HPE Analytics and Location Engine (ALE) deployment can yield limited sensitive-infor
Command execution in the HPE Analytics and Location Engine (ALE) web interface allows remote, high-privilege authenticat
Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrat
Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first estab
Unauthenticated information disclosure in the HPE Aruba Analytics and Location Engine (ALE) API allows any remote attack
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today