CVE-2026-76708

A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials. Successful exploitation could result in an attacker gaining unauthorized access to the application's management interface and the underlying operating system, potentially leading to full system compromise.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:arubanetworks:analytics_and_location_engine:*:*:*:*:*:*:*:*

History

25 Sep 2026, 18:01

Type	Values Removed	Values Added
CPE		cpe:2.3:a:arubanetworks:analytics_and_location_engine::::::::
References	~~() https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US -~~	() https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US - Vendor Advisory
First Time		Arubanetworks Arubanetworks analytics And Location Engine

23 Sep 2026, 21:17

Type	Values Removed	Values Added
CWE		CWE-798

22 Sep 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-22 20:17

Updated : 2026-09-25 18:01

NVD link : CVE-2026-76708

Mitre link : CVE-2026-76708

CVE.ORG link : CVE-2026-76708

JSON object : View

Products Affected

arubanetworks

analytics_and_location_engine

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2026-76708", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76708", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-23T12:03:41.802243Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-alert@hpe.com", "affectedData": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "ALE", "versions": [{"status": "affected", "version": "0.0.0.0", "versionType": "semver", "lessThanOrEqual": "5.0.0.0"}], "defaultStatus": "affected"}]}], "published": "2026-09-22T20:17:06.620", "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials.\n\nSuccessful exploitation could result in an attacker gaining unauthorized access to the application's management interface and the underlying operating system, potentially leading to full system compromise."}], "lastModified": "2026-09-25T18:01:52.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arubanetworks:analytics_and_location_engine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BF5CD19-1EEB-4CA5-9A41-8C6A1F196579", "versionEndExcluding": "5.1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@hpe.com"}