CVE-2026-76717

MediumCVSS 5.3/10Last modified Sep 28, 2026

Description

A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result in the disclosure of sensitive user information, including password hashes, which could be used to facilitate further attacks.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Sep 22, 2026
Last modified
Sep 28, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-767188.2A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions.CVE-2026-767198.2A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions.CVE-2026-76726.3A security vulnerability has been detected in youlaitech youlai-boot up to 2.21.1. This affects the function getUserList of the file src/maiCVE-2026-767204.3A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect.CVE-2026-767219.8Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacCVE-2026-767229.8Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticaCVE-2026-767239.6Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacenCVE-2026-767249.6A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent aCVE-2026-767259.6A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent aCVE-2026-767268.1An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to byCVE-2026-767277.2Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attaCVE-2026-767287.2A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to co
CVE-2026-76717: Medium severity, CVSS 5.3 | Vulnix