CVE-2026-76727 is a command injection vulnerability in Hewlett Packard Enterprise (HPE) Instant ON networking devices. It affects versions from 0.0.0.0 up to and including 3.4.1.0. An authenticated remote attacker with high privileges could exploit this flaw to execute arbitrary commands on the underlying operating system. The vulnerability has a high severity rating with a CVSS score of 7.2. No patch or vendor advisory information is provided regarding remediation status.
CVE-2026-76726 is an authentication bypass vulnerability in the API endpoint of Hewlett Packard Enterprise (HPE) Networking Instant ON. This flaw could allow an unauthenticated remote attacker to bypass network access controls if certain external preconditions are met. Exploitation may lead to unauthorized access to restricted networks. The vulnerability affects versions up to and including 3.4.1.0. It has a high severity rating with a CVSS score of 8.1. No official patch or remediation details are provided in the available data.
CVE-2026-76725 is a critical vulnerability in the management protocol of Hewlett Packard Enterprise (HPE) Instant ON Access Points. It allows an unauthenticated adjacent attacker to bypass authentication controls, potentially leading to remote code execution with elevated privileges. The vulnerability affects versions from 0.0.0.0 up to and including 3.4.1.0. The CVSS 3.1 base score is 9.6, indicating a high severity with network attack vector requiring adjacency, low attack complexity, no privileges or user interaction needed, and complete confidentiality, integrity, and availability impact.
CVE-2026-76724 is a critical command injection vulnerability in the CLI of Hewlett Packard Enterprise (HPE) Instant ON networking access points. An unauthenticated adjacent attacker can exploit this flaw by sending specially crafted packets, allowing arbitrary command execution with privileged user rights on the underlying operating system. The vulnerability affects versions up to and including 3.4.1.0. No known exploits are reported in the wild, and no patch information is currently provided.
CVE-2026-76723 is a critical buffer overflow vulnerability in Hewlett Packard Enterprise (HPE) Instant ON Networking APS. It allows an unauthenticated adjacent attacker to execute arbitrary commands on the underlying operating system, potentially leading to full system compromise. The vulnerability affects versions from 0.0.0.0 up to and including 3.4.1.0. There is no information provided about an available patch or vendor advisory. The CVSS score is 9.6, indicating a critical severity level.
CVE-2026-76722 is a critical uncontrolled format string vulnerability in Hewlett Packard Enterprise (HPE) Instant ON networking access points. It allows an unauthenticated remote attacker to execute arbitrary commands on the device, potentially causing denial of service or remote code execution. The vulnerability affects versions up to and including 3.4.1.0. No patch information is provided, and no known exploits are reported in the wild.
CVE-2026-76721 is a critical buffer overflow vulnerability in Hewlett Packard Enterprise (HPE) Instant ON networking product. It allows an unauthenticated remote attacker to execute arbitrary code with privileged operating system rights. The vulnerability affects versions from 0.0.0.0 up to and including 3.4.1.0. No patch information is provided, and no known exploits are reported in the wild.
CVE-2026-76717 is a medium severity vulnerability in Hewlett Packard Enterprise's Analytics and Location Engine (ALE) API. It allows an unauthenticated remote attacker to disclose sensitive information, including password hashes, by sending specially crafted input to a specific API endpoint. This vulnerability could facilitate further attacks if exploited. No known exploits are reported in the wild. The affected versions are from 0.0.0.0 up to and including 5.0.0.0. No patch or remediation information is currently provided.
Multiple vulnerabilities in Hewlett Packard Enterprise's Analytics and Location Engine (ALE) could allow unauthenticated remote attackers to cause denial of service or gain unauthorized access. These issues stem from improper security configurations and specially crafted inputs. The vulnerabilities affect ALE versions up to and including 5.0.0.0. The overall severity is medium with a CVSS score of 5.3.
CVE-2026-76715 is a high-severity vulnerability in Hewlett Packard Enterprise's Analytics and Location Engine (ALE) administrative component. It allows a man-in-the-middle (MitM) attack that could enable an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected appliance. The vulnerability affects ALE versions from 0.0.0.0 up to and including 5.0.0.0. The CVSS score is 7.1, indicating a high impact on confidentiality, integrity, and availability. No patch or vendor advisory information is provided, and no known exploits are reported in the wild.
CVE-2026-76714 is a high-severity vulnerability in Hewlett Packard Enterprise's Analytics and Location Engine (ALE) web interface. It allows remote authenticated users to execute arbitrary commands as root on the underlying operating system, potentially leading to complete system compromise. The vulnerability affects ALE versions from 0.0.0.0 up to and including 5.0.0.0. There is no information provided about available patches or vendor advisories. No known exploits are reported in the wild.
CVE-2026-76713 is a high-severity vulnerability in Hewlett Packard Enterprise's Analytics and Location Engine (ALE). It affects the maintenance restore functionality and allows an authenticated remote attacker to gain unauthorized root-level access to the file system. This could lead to full system compromise. The vulnerability affects ALE versions from 0.0.0.0 up to and including 5.0.0.0. No patch information is currently available.
CVE-2026-76712 is a high-severity vulnerability in Hewlett Packard Enterprise's Analytics and Location Engine (ALE) that allows unauthenticated remote attackers to cause unauthorized access, information disclosure, or denial of service. Exploitation involves sending specially crafted input or intercepting network communications. The affected versions range from 0.0.0.0 up to and including 5.0.0.0. There is no information about available patches or vendor advisories at this time.
A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful exploitation could result in unauthorized data injection.
A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful exploitation could result in the disclosure of sensitive site hierarchy, infrastructure details, and client device information.
A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting in full system compromise.
A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials.
Successful exploitation could result in an attacker gaining unauthorized access to the application's management interface and the underlying operating system, potentially leading to full system compromise.
CVE-2026-76707 is a medium severity vulnerability in Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways. It allows an unauthenticated adjacent attacker to view some system memory contents. This exposure could provide insight into internal services and workflows, potentially increasing the risk of unauthorized access or privilege escalation when combined with other vulnerabilities. The vulnerability affects specific versions of EdgeConnect SD-WAN Gateway software.
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could result in the disclosure of security-relevant configuration details and security feature status, which could be used to facilitate further attacks.
A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system.