CVE-2026-76717: Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)
Published Sep 22, 2026
·Updated
A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result in the disclosure of sensitive user information, including password hashes, which could be used to facilitate further attacks.
Affected Software
1 affected component
HPE Networking Analytics and Location Engine (ALE)
Event History
Sep 22, 2026
CVE Published
via MITRE·07:12 PM
Data Sourced
via MITRE·07:12 PM
DescriptionSeverity
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
No authentication or prior privileges are required. An attacker would need remote access to the affected ALE API endpoint and would exploit it with specially crafted input.
2
What information could be exposed if exploitation succeeds?
Sensitive user information may be disclosed, including password hashes. Exposed hashes could be used to facilitate further attacks.