HPE Networking bug bounty programs
arubanetworks.com Updated
HPE Networking runs one public program: a Bugcrowd bug bounty paying up to $5,000.
- Top reward
- $5,000
- Bugcrowd
- Programs
- 1
- 1 pays cash
- Targets in scope
- 20
- 5 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program HPE Networking runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
HPE Networking Product Public Program
Bugcrowd · Bug bounty |
$5,000 | $3,000 | $1,200 | $600 | $5,000 | Full | – | – | Open |
-
- Critical
- $5,000
- High
- $3,000
- Medium
- $1,200
- Low
- $600
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
20 targets. 2 excluded.
-
*.central.arubanetworks.com
Wildcards
-
HPE Aruba Networking Central - New UI (see Scope Details)
Web
-
HPE Aruba Networking Private 5G
Web
-
Aruba User Experience Insight Sensors
Hardware and IoT
-
HPE Aruba Networking Fabric Composer
IP ranges
-
HPE Aruba Networking NetEdit
IP ranges
-
HPE Aruba Networking Wireless - AOS-10.4 Access Points (AP)
IP ranges
-
HPE Aruba Networking Wireless - AOS-10.4 Gateways (GW)
IP ranges
-
HPE Aruba Networking Wireless - AOS-10.7 and above Access Points (AP)
IP ranges
-
HPE Aruba Networking Wireless - AOS-10.7 and above Gateways (GW)
IP ranges
-
HPE Aruba Networking Wireless - AOS-8 Instant AP (IAP)
IP ranges
-
Aruba AirWave AMP
Products and areas
-
Aruba InstantOn Switches
Products and areas
-
ArubaOS-CX Switches
Products and areas
-
HPE Aruba Networking ClearPass Policy Manager
Products and areas
-
HPE Aruba Networking EdgeConnect SD-WAN Orchestrator
Products and areas
-
HPE Aruba Networking SSE
Products and areas
-
HPE Aruba Networking VIA
Products and areas
-
HPE Aruba Networking Wireless - AOS-8 Controllers
Products and areas
-
HPE Networking Instant On APs and supporting backend infrastructure
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 2
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.arubanetworks.com not in scope above - see in scope
-
*.hpe.com
Recent changes
Reward and scope changes across every HPE Networking program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in HPE Networking products, from the NVD.
-
CVE-2026-76716 Medium
Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted input or leveraging improper security configurations. Successful exploitation could result in a denial of service condition or unauthorized access to sensitive infor
-
CVE-2026-76717 Medium
A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result in the disclosure of sensitive user information, including password hashes, which could be used to f
-
CVE-2026-76708 Critical
A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials. Successful exploitation could result in an attacker gaining unaut
-
CVE-2026-76709 Critical
A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting in full system compromise.
-
CVE-2026-76710 High
A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful exploitation could result in the disclosure of sensitive site hierarchy, infrastructure details, and clie
-
CVE-2026-76711 High
A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful exploitation could result in unauthorized data injection.
-
CVE-2026-76712 High
A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications. Successful exploitation could result in the disclosure of sensitive information, bypass of security co
-
CVE-2026-76713 High
A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full system compromise.
About this page
This page gathers every public program listed under arubanetworks.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.