{"id":"CVE-2026-76709","state":"PUBLISHED","title":"Unauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE)","description":"A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting in full system compromise.","publishedAt":"2026-09-22T19:12:25.783Z","updatedAt":"2026-09-23T20:01:06.732Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"hpe"},"assigner":"hpe","products":["Hewlett Packard Enterprise (HPE) ALE"],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ALE","defaultStatus":"affected","versions":[{"version":"0.0.0.0","status":"affected","lessThanOrEqual":"5.0.0.0","versionType":"semver"}]}],"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/76xxx/CVE-2026-76709.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-76709","state":"PUBLISHED","datePublished":"2026-09-22T19:12:25.783Z","dateUpdated":"2026-09-23T20:01:06.732Z","assignerShortName":"hpe","assignerOrgId":"eb103674-0d28-4225-80f8-39fb86215de0","dateReserved":"2026-08-19T16:12:27.185Z"},"containers":{"cna":{"title":"Unauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE)","descriptions":[{"lang":"en","value":"A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting in full system compromise."}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ALE","defaultStatus":"affected","versions":[{"version":"0.0.0.0","status":"affected","lessThanOrEqual":"5.0.0.0","versionType":"semver"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","availabilityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"providerMetadata":{"shortName":"hpe","orgId":"eb103674-0d28-4225-80f8-39fb86215de0","dateUpdated":"2026-09-22T19:12:25.783Z"},"credits":[{"lang":"en","type":"reporter","value":"Internal security research (HPE Networking)."}],"source":{"advisory":"HPESBNW05137","discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-23T12:05:22.333739Z","id":"CVE-2026-76709","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"CWE-284 Improper Access Control"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-23T20:01:06.732Z"}}]}}}