Description
A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result in the disclosure of sensitive user information, including password hashes, which could be used to facilitate further attacks.
Published: 2026-09-22
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Sensitive Information Disclosure
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in the Analytics and Location Engine API that permits an unauthenticated remote attacker to supply crafted input to a specific endpoint. If successful, the attacker can obtain sensitive user data, including password hashes, which could be leveraged for further compromise.

Affected Systems

Hewlett Packard Enterprise Networking Analytics and Location Engine (ALE) is affected. The CVE description does not enumerate specific version ranges, so all deployable instances of ALE are presumed vulnerable until updates are verified.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the issue is not in the CISA KEV catalog, suggesting limited but possible exploitation. The attack vector is likely remote via the exposed API, requiring no authentication. The disallowed disclosure of credentials could enable credential-based attacks or lateral movement within the network.

Generated by OpenCVE AI on September 22, 2026 at 21:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest official HPE ALE security patch that addresses the vulnerability.
  • Configure the ALE API to require authentication for all endpoints and disable anonymous access.
  • Segment network traffic so that only trusted hosts can reach the ALE API, and monitor logs for anomalous requests.

Generated by OpenCVE AI on September 22, 2026 at 21:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Arubanetworks
Arubanetworks analytics And Location Engine
CPEs cpe:2.3:a:arubanetworks:analytics_and_location_engine:*:*:*:*:*:*:*:*
Vendors & Products Arubanetworks
Arubanetworks analytics And Location Engine

Wed, 23 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) ale
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) ale

Tue, 22 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Description A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result in the disclosure of sensitive user information, including password hashes, which could be used to facilitate further attacks.
Title Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Arubanetworks Analytics And Location Engine
Hewlett Packard Enterprise (hpe) Ale
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-09-22T20:01:32.935Z

Reserved: 2026-08-19T16:12:51.871Z

Link: CVE-2026-76717

cve-icon Vulnrichment

Updated: 2026-09-22T20:01:23.877Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-22T20:17:07.723

Modified: 2026-09-28T14:08:04.563

Link: CVE-2026-76717

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T09:12:05Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor