EUVD-2026-75125
GHSA-cp6v-rvjv-v4j7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to ClearPass OnGuard with low-privilege credentials
-
DeliverySend crafted network request to vulnerable OnGuard agent interface
-
ExploitTrigger improper privilege validation flaw
-
ExecutionObtain root privileges on OnGuard host
-
ImpactUnauthorized system operation or policy manipulation
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to hold a valid authenticated session with at least low-level privileges on the ClearPass OnGuard deployment (PR:L per CVSS vector). The attack is network-accessible (AV:N), meaning the attacker does not need physical or local access. No user interaction is required (UI:N) and attack complexity is low (AC:L), implying no race conditions or non-default configurations must be present. The principal limiting factor is possession of any authenticated credential on the targeted ClearPass OnGuard system - unauthenticated exploitation is not supported by the CVSS vector. The scope is unchanged (S:U), confining the direct impact to the vulnerable OnGuard host itself rather than adjacent systems. |
| Impact | The provided CVSS score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N is likely conservative: root privilege escalation realistically implies full CIA triad impact, yet the provided vector records only I:H. This discrepancy warrants verification against the HPE advisory - even a mid-sized municipal IT team in walbrzych managing ClearPass for campus NAC should treat this as urgent given that root access on a NAC controller could allow policy bypass, network admission manipulation, or host takeover. No EPSS data was supplied and no KEV listing exists, suggesting no confirmed mass exploitation at time of analysis. The low-privilege requirement (PR:L) means any authenticated OnGuard user - potentially including low-trust network clients enrolled in the NAC system - is a viable threat actor, widening the attack surface considerably. |
| Exploit ScenarioDerived | An attacker with a low-privileged account on the ClearPass OnGuard deployment - such as a standard NAC-enrolled user or a service account - sends a crafted network request to the vulnerable OnGuard agent interface, triggering an improper privilege check that promotes their session to root. With root access, the attacker can modify NAC policies, install backdoors, or pivot into connected network segments. No public exploit code has been identified, but the low attack complexity (AC:L) suggests the technique would be straightforward to develop. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Privilege escalation in the HPE Aruba ClearPass OnGuard agent enables an authenticated network-accessible attacker with low privileges to elevate to root on the affected deployment. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation requiring no user interaction, making it straightforward to weaponize for any attacker who holds even a basic account on the system. No public exploit code or CISA KEV listing has been identified at time of analysis; HPE has published advisory hpesbnw05130en_us, which presumably details affected versions and remediation.
RemediationAI
Apply the patch or updated ClearPass OnGuard version specified in HPE security bulletin hpesbnw05130en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05130en_us&docLocale=en_US). Because no specific fix version was included in the available intelligence data, the advisory must be consulted to identify the exact target version. As a compensating control pending patching, restrict network access to ClearPass OnGuard management interfaces to only trusted administrative hosts using firewall ACLs or segmentation policies, reducing the pool of principals who can reach the vulnerable endpoint. Additionally, audit all accounts with any level of access to OnGuard and reduce privilege grants to the minimum necessary; this limits the attacker pool without eliminating the underlying flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ClearPass is HPE Aruba's Network Access Control (NAC) platform used extensively in enterprise environments to enforce policy-based network access. The OnGuard component is the endpoint posture-assessment agent that runs on client devices or servers participating in the NAC framework. The vulnerability exists within OnGuard's privilege-handling logic - an authenticated low-privileged user can trigger a code path that grants root-level system access. CWE is listed as N/A by the reporter, but the root cause class is most consistent with improper privilege management (CWE-269) or an insecure privileged IPC/API interface exposed to lower-privileged callers. The network attack vector (AV:N) indicates the exploitation surface is reachable over the network rather than only locally.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Root privilege escalation realistically implies full CIA triad impact; C:N and A:N in the provided vector appear inconsistent with obtaining root access.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to elevate their own privileges on a vulnerable ClearPass OnGuard deployment. Successful exploitation could allow an attacker to obtain root privileges, leading to potentially unauthorized operation of the vulnerable system.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB