Log in / Sign up

Vulnerability details

CVE-2026-76708

Hewlett Packard Enterprise (HPE) ALE

Unauthenticated Remote Unauthorized Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)

CVSS 3.1
9.8Critical

Official description

A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials. Successful exploitation could result in an attacker gaining unauthorized access to the application's management interface and the underlying operating system, potentially leading to full system compromise.

CVSS scores

ScoreVersionSourceVector
9.8Critical 3.1 CVEProject cvelistV5 (CNA) (hpe) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
Hewlett Packard Enterprise (HPE) ALE 0.0.0.0 ≤ v ≤ 5.0.0.0 CVEProject cvelistV5 (CNA)

References and advisories

1
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-09-22
Last updated
2026-09-23
State
Published
Assigner (CNA)
hpe

Exploit prediction (EPSS)

0.59%
Probability of exploitation in 30 days
48.5%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
None
Technical impact
Total

Weaknesses (CWE)

  • CWE-798
    Use of Hard-coded Credentials