CVE-2026-76715CWE-300

CVE-2026-76715

High · published September 23, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
16.7
In the wild
Unconfirmed
What it is

A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected appliance.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00259 · 16.7th percentile
Weakness
CWE-300 · Channel Accessible by Non-Endpoint
Published
2026-09-23T00:17Z
Affected products (1)
ProductVersionsFixed in
arubanetworks/analytics_and_location_engine< 5.1.0.05.1.0.0
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 22 SEP 19:12Z
    Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulnerability in HPE Networking Analytics and Location Engine (ALE)
    cvelistv5