CVE-2026-76714

HighCVSS 7.2/10Last modified Sep 28, 2026

Description

Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Sep 22, 2026
Last modified: Sep 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-767157.1A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Su CVE-2026-767165.3Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or denial of service. An un CVE-2026-767175.3A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthe CVE-2026-767188.2A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions.CVE-2026-767198.2A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions.CVE-2026-76726.3A security vulnerability has been detected in youlaitech youlai-boot up to 2.21.1. This affects the function getUserList of the file src/mai CVE-2026-767204.3A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect.CVE-2026-767219.8Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attac CVE-2026-767229.8Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthentica CVE-2026-767239.6Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacen CVE-2026-767249.6A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent a CVE-2026-767259.6A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent a