CVE-2026-76734

Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in HPE Networking Instant On

A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service and to access some limited information within the affected component.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Instant On

CVE-2026-76735

Authenticated Local Sensitive Information Disclosure in HPE Networking Instant On

A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authenticated local attacker with high privileges to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Instant On, only if certain preconditions outside of the attacker's control are met.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Instant On

CVE-2026-76738

Authenticated Buffer Overflow Vulnerability in the API Endpoint of HPE Networking Instant On Causes Denial-of-Service

A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service, which recovers without manual intervention.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Instant On

CVE-2026-76717

Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result in the disclosure of sensitive user information, including password hashes, which could be used to facilitate further attacks.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Analytics And Location Engine Ale

CVE-2026-76716

Unauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)

Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted input or leveraging improper security configurations. Successful exploitation could result in a denial of service condition or unauthorized access to sensitive information.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Analytics And Location Engine Ale

CVE-2026-76715

Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected appliance.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Analytics And Location Engine Ale

CVE-2026-76714

Authenticated Remote Code Execution with Elevated Privileges Vulnerability in HPE Networking Analytics and Location Engine (ALE)

Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Analytics And Location Engine Ale

CVE-2026-76713

Authenticated Remote File System Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full system compromise.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Analytics And Location Engine Ale

CVE-2026-76712

Unauthenticated Remote Unauthorized Access, Information Disclosure, and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications. Successful exploitation could result in the disclosure of sensitive information, bypass of security controls, or a denial of service condition on the affected system.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Analytics And Location Engine Ale

CVE-2026-76709

Unauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting in full system compromise.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Analytics And Location Engine Ale

CVE-2026-76710

Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful exploitation could result in the disclosure of sensitive site hierarchy, infrastructure details, and client device information.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Analytics And Location Engine Ale

CVE-2026-76711

Unauthenticated Remote Data Injection Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful exploitation could result in unauthorized data injection.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Analytics And Location Engine Ale

CVE-2026-76685

Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input that triggers an integer overflow. Successful exploitation could result in a buffer overflow, potentially leading to remote code execution or denial-of-service.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe) Hpe

Products

Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System

CVE-2026-76689

Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed. An authenticated remote attacker with administrative privileges could exploit this vulnerability by providing specially crafted configuration data. Successful exploitation could result in a stack-based buffer overflow, potentially leading to remote code execution with root privileges or a denial of service due to a system crash.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe) Hpe

Products

Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System

CVE-2026-76682

Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker to exploit a limited buffer overflow. Successful exploitation could allow an attacker to cause a denial-of-service or potentially execute arbitrary code on the system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe) Hpe

Products

Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System

CVE-2026-76686

Unauthenticated Denial-of-Service (DoS) Vulnerability leads to Service Disruption in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability exists in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an unauthenticated remote attacker to conduct a denial-of-service attack on the affected service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe) Hpe

Products

Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System

CVE-2026-76690

Authenticated Remote Code Execution Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An authenticated remote attacker could exploit this vulnerability by providing a specially crafted input to the affected component. Successful exploitation could result in remote code execution as root.

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe) Hpe

Products

Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System

CVE-2026-76691

Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateway API Endpoint

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe) Hpe

Products

Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System

CVE-2026-76698

Authenticated Command Injection Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

A command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker with limited access privileges could exploit this vulnerability through specially crafted input. Successful exploitation, under certain conditions, could result in the execution of arbitrary commands with elevated privileges or a denial-of-service condition on the affected appliance.

CVSS 3.1 · 6.5 Medium EPSS 4.5% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe) Hpe

Products

Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System

CVE-2026-76700

Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways

Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe) Hpe

Products

Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System