Skip to main content

Aruba ALE CVE-2026-76717

| EUVDEUVD-2026-84677 MEDIUM
Information Exposure (CWE-200)
2026-09-22 hpe GHSA-6f6p-42hc-hhx8
Information Disclosure Hpe Hewlett Packard Enterprise Hpe Ale
5.3
CVSS 3.1 · Vendor: hpe
Share

Severity by source

Vendor (hpe) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
7.5 HIGH

Unauthenticated network access to an API endpoint (AV:N/AC:L/PR:N/UI:N); C:H because disclosed data includes password hashes (credential material), with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hpe).

CVSS VectorVendor: hpe

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Metadata Corrected
Sep 22, 2026 - 20:40 vuln.today
tag: Hpe added
Analysis Generated
Sep 22, 2026 - 19:52 vuln.today

DescriptionCVE.org

A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result in the disclosure of sensitive user information, including password hashes, which could be used to facilitate further attacks.

AnalysisAI

Unauthenticated information disclosure in the HPE Aruba Analytics and Location Engine (ALE) API allows any remote attacker who can reach the service to submit specially crafted input to a specific endpoint and retrieve sensitive user data, including password hashes, which can then be cracked or reused to pivot into other systems. No credentials, privileges, or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so the only practical barrier is network exposure of the ALE API, which is typically an internal Aruba/HPE wireless location-analytics component. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires only network reachability to the Analytics and Location Engine (ALE) API - specifically the ability to send crafted input to one particular vulnerable API endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor (HPE) CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3, MEDIUM) describes a network-reachable, low-complexity, unauthenticated information-disclosure flaw with no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch version is confirmed in the provided intelligence, so treat HPE Security Bulletin hpesbnw05137en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US) as the authoritative source for the fixed ALE build and apply it as soon as HPE publishes an affected/fixed version matrix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ale

View all
CVE-2026-76708 CRITICAL POC
9.8 Sep 22

Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
CVE-2026-76709 CRITICAL
9.8 Sep 22

Unauthenticated remote write access to the file system with elevated privileges in HPE Analytics and Location Engine (AL
CVE-2026-76710 HIGH
7.5 Sep 22

Information disclosure in HPE ALE management interface allows unauthenticated remote attackers to retrieve sensitive sit
CVE-2026-76711 HIGH
7.5 Sep 22

Unauthenticated data injection in HPE's Analytics and Location Engine (ALE) lets any attacker who can reach the ALE serv
CVE-2026-76712 HIGH
7.3 Sep 22

Unauthenticated remote access to an HPE Analytics and Location Engine (ALE) deployment can yield limited sensitive-infor
CVE-2026-76714 HIGH
7.2 Sep 22

Command execution in the HPE Analytics and Location Engine (ALE) web interface allows remote, high-privilege authenticat
CVE-2026-76713 HIGH
7.2 Sep 22

Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrat
CVE-2026-76715 HIGH
7.1 Sep 22

Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first estab
CVE-2026-76716 MEDIUM
5.3 Sep 22

Unauthenticated, network-reachable attacks against HPE Aruba Analytics and Location Engine (ALE) can degrade or knock ou

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2021-41277 HIGH POC
7.5
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-76717 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy