---
id: CVE-2026-76717
title: >-
  A vulnerability exists in the Analytics and Location Engine (ALE) API that may
  allow for the disclosure of sensitive information
summary: >-
  A vulnerability exists in the Analytics and Location Engine (ALE) API that may
  allow for the disclosure of sensitive information. An unauthenticated remote
  attacker could exploit this vulnerability by providing specially crafted input
  to…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
vendor: arubanetworks
product: analytics_and_location_engine
affected:
  - analytics_and_location_engine < 5.1.0.0
patched:
  - analytics_and_location_engine 5.1.0.0
published: '2026-09-22'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T14:08:04.563'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76717'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US
    label: security-alert@hpe.com
tags:
  - nvd
  - cve.org
epss: 0.0042
epssPercentile: 0.36109
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-22T20:01:28.413694Z'
ingestedAt: '2026-09-22T20:10:15.094Z'
---

## Overview

A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result in the disclosure of sensitive user information, including password hashes, which could be used to facilitate further attacks.

## Affected

- `analytics_and_location_engine < 5.1.0.0`

## Remediation

Upgrade past the affected range:

- `analytics_and_location_engine 5.1.0.0`