Information disclosure in Hewlett Packard Enterprise (HPE) Ale
CVE-2026-76717
A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result in the disclosure of sensitive user information, including password hashes, which could be used to facilitate further attacks.
Vulnerability class: Information Disclosure
Published .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-76717?
- CVE-2026-76717 is a medium-severity vulnerability in Hewlett Packard Enterprise (HPE) Ale, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-09-22.
- How severe is CVE-2026-76717?
- Medium severity. CVSS v3 base score is 5.3 out of 10.