EUVD-2026-84670
GHSA-hghw-mxqv-858r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network requests to internal endpoints (AV:N/AC:L/PR:N/UI:N) disclose sensitive infrastructure and client data (C:H), with no integrity or availability impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful exploitation could result in the disclosure of sensitive site hierarchy, infrastructure details, and client device information.
AnalysisAI
Information disclosure in HPE ALE management interface allows unauthenticated remote attackers to retrieve sensitive site hierarchy, infrastructure details, and client device information via specially crafted requests to internal endpoints. Despite the absence of exploitation telemetry, this is a high-priority remotely-exploitable exposure because the flaw requires no authentication, no user interaction, and low attack complexity; the primary limiting factor is network reachability to the management interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the HPE ALE (Analytics and Location Engine) management interface and the ability to send requests to specific internal endpoints; no authentication, no user interaction, and no special client-side configuration are needed (PR:N/UI:N/AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-priority remotely-exploitable exposure signal despite the absence of exploitation telemetry. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; monitor the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US for updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which HPE ALE management instances are deployed, document their exact product version and build from the HPE support portal, and determine whether any of them are reachable from untrusted networks or the public internet; for any internet-facing instance, immediately block external access and place the management interface behind a VPN or an allow-listed jump host. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
Unauthenticated remote write access to the file system with elevated privileges in HPE Analytics and Location Engine (AL
Unauthenticated data injection in HPE's Analytics and Location Engine (ALE) lets any attacker who can reach the ALE serv
Unauthenticated remote access to an HPE Analytics and Location Engine (ALE) deployment can yield limited sensitive-infor
Command execution in the HPE Analytics and Location Engine (ALE) web interface allows remote, high-privilege authenticat
Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrat
Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first estab
Unauthenticated, network-reachable attacks against HPE Aruba Analytics and Location Engine (ALE) can degrade or knock ou
Unauthenticated information disclosure in the HPE Aruba Analytics and Location Engine (ALE) API allows any remote attack
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today