CVE-2026-76711CWE-20

CVE-2026-76711

High · published September 23, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
39.3
In the wild
Unconfirmed
What it is

A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful exploitation could result in unauthorized data injection.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00465 · 39.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-09-23T00:17Z
Affected products (1)
ProductVersionsFixed in
arubanetworks/analytics_and_location_engine< 5.1.0.05.1.0.0
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 22 SEP 19:12Z
    Unauthenticated Remote Data Injection Vulnerability in HPE Networking Analytics and Location Engine (ALE)
    cvelistv5