Threat Intelligence Database

A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result in the disclosure of sensitive user information, including password hashes, which could be used to facilitate further attacks.

A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected appliance.

Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full system compromise.

A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications. Successful exploitation could result in the disclosure of sensitive information, bypass of security controls, or a denial of service condition on the affected system.

CVE-2026-76711 is a high-severity vulnerability in Hewlett Packard Enterprise's Analytics and Location Engine (ALE) component. The flaw arises from improper processing of incoming socket connections, allowing an unauthenticated remote attacker to inject unauthorized data by sending specially crafted input during connection establishment. This vulnerability affects ALE versions from 0.0.0.0 up to and including 5.0.0.0. No known exploits are reported in the wild, and no patch information is currently provided.

CVE-2026-76709 is a critical vulnerability in Hewlett Packard Enterprise's Analytics and Location Engine (ALE) internal administrative component. It allows an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially leading to full system compromise. The vulnerability affects ALE versions from 0.0.0.0 up to and including 5.0.0.0. The CVSS score is 9.8, indicating a high severity with network attack vector, no required privileges or user interaction, and full confidentiality, integrity, and availability impact.