CVE-2026-76717 Information disclosure in ALE
Unauthenticated remote attackers can exploit an API endpoint to disclose sensitive user information, including password hashes, in HPE ALE.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76717?
CVE-2026-76717 is a medium-severity vulnerability in Hewlett Packard Enterprise (HPE) ALE, published on 22 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result in the disclosure of sensitive user information, including password hashes, which could be used to facilitate further attacks.
Weakness: CWE-200
Which versions are affected by CVE-2026-76717?
It affects 1 product.
Products include Arubanetworks Analytics and Location Engine.
How do I fix CVE-2026-76717?
No fix has been published for CVE-2026-76717 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-76717 being exploited?
There is no known exploitation of CVE-2026-76717 in the wild and no public exploit code.
Other vulnerabilities in Hewlett Packard Enterprise (HPE) ALE
- CVE-2026-76708 Unauthenticated Remote Unauthorized Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)
- CVE-2026-76709 Unauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE)
- CVE-2026-76710 Information disclosure in ALE
- CVE-2026-76711 Unauthenticated Remote Data Injection Vulnerability in HPE Networking Analytics and Location Engine (ALE)
- CVE-2026-76712 Information disclosure in ALE
Sources
Also known as GHSA-6f6p-42hc-hhx8.