Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) vulnerabilities

CVE-2026-76752 Critical · 9.8 CWE-287 Oct 6, 2026

Authentication Bypass Vulnerabilities in HPE Networking ClearPass Policy Manager Allow Unauthorized Administrative Access

Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authentication controls and gain administrative access to the affected system.

CVE-2026-76751 Critical · 9.8 CWE-353 Oct 6, 2026

Missing Integrity Verification in the OnGuard Agent of ClearPass Policy Manager Allows Unauthenticated Remote Code Execution

A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an unauthenticated, remote attacker to execute arbitrary code on the affected endpoint with the elevated privileges of the agent.

CVE-2026-76750 Critical · 9.8 CWE-502 Oct 6, 2026

Unauthenticated Deserialization of Untrusted Data allows Remote Code Execution in the Web Interface of HPE Networking ClearPass Policy Manager

Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.

CVE-2026-73789 Medium · 5.3 CWE-284 Sep 9, 2026

Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web Interface

A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attacker to manipulate account settings. Successful exploitation could allow an attacker to extend network access beyond policy limits, leading to unauthorized prolonged use of network resources.

CVE-2026-73788 Medium · 6.5 CWE-269 Sep 9, 2026

Privilege Escalation in ClearPass OnGuard Agent

A vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to elevate their own privileges on a vulnerable ClearPass OnGuard deployment. Successful exploitation could allow an attacker to obtain root privileges, leading to potentially unauthorized operation of the vulnerable system.

CVE-2026-73787 High · 7.2 CWE-78 Sep 9, 2026

Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-73786 High · 7.5 CWE-400 Sep 9, 2026

Unauthenticated Network-Based Denial of Service in CPPM systems

A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack. Successful exploitation could allow an attacker to cause instability and degrade performance of the vulnerable CPPM server.

CVE-2026-73769 High · 7.2 CWE-78 Sep 9, 2026

Authenticated Remote Code Execution in CPPM Web Interface

A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.