HPE Networking ALE Vulnerabilities Enable Authentication Bypass, Root Access and Data Exposure
Brief
Hewlett Packard Enterprise has released security updates for HPE Networking Analytics and Location Engine (ALE) to remediate 10 vulnerabilities, including two critical flaws that could enable unauthenticated remote compromise.
The issues affect ALE version 5.
- 0. 0 and earlier, while the vendor has released ALE 5.
- 0. 0 as the fixed version.
Tracked in security bulletin HPESBNW05137 rev.1, published September 22, 2026, the vulnerability set includes authentication bypass, arbitrary file write, sensitive-information disclosure, data injection, denial-of-service , and root-level code-execution risks.
HPE Networking ALE Vulnerabilities
The two most severe bugs, CVE-2026-76708 and CVE-2026-76709, each carry a CVSS v3. 1 score of 9.
- CVE-2026-76708 stems from default, hard-coded credentials used by multiple ALE administrative and system accounts.