Hewlett Packard Enterprise advisory HPESBNW05137 (rev.1, 22 September 2026) covers multiple flaws in HPE Networking Analytics and Location Engine (ALE) ≤ 5.0.0.0, fixed in ALE 5.1.0.0. Lead criticals: CVE-2026-76708 (CVSS 9.8) — default hard-coded credentials on administrative/system accounts enabling unauthenticated remote login to the ALE management interface and underlying OS (CWE-798); CVE-2026-76709 (CVSS 9.8) — unauthenticated remote arbitrary file write with elevated privileges via an internal administrative component.

Additional highs include info disclosure, data injection, auth’d root filesystem/command execution, MitM RCE, and API password-hash disclosure (CVE-2026-76710 through CVE-2026-76717).

HPE said it was not aware of any public discussion or exploit code targeting the flaws as of the advisory's release date. (sources: HPE HPESBNW05137; CVE.report; Tenable CVE pages)

Correction (27 Oct 2026): HPE's bulletin says it is not aware of public discussion or exploit code; it does not address active exploitation, so the card no longer says it did. (source: HPE HPESBNW05137)