CVE-2026-76715: arubanetworks analytics_and_location_engine Channel Accessible by Non-Endpoint

Vulnerability summary

CVE-2026-76715 is a high (CVSS 7.1) Channel Accessible by Non-Endpoint vulnerability in arubanetworks analytics_and_location_engine. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.5% of scored vulnerabilities.

Timeline

1. 22-09-2026
   PublishedVulnerability first disclosed.
2. 22-09-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected appliance.

• CWE-300Channel Accessible by Non-EndpointThe product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.