EUVD-2026-75126
GHSA-wxp5-6vxp-r6fw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network access, no complexity barrier; impact is limited to guest account integrity modification with no confidentiality or availability consequence.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attacker to manipulate account settings. Successful exploitation could allow an attacker to extend network access beyond policy limits, leading to unauthorized prolonged use of network resources.
AnalysisAI
Unauthenticated manipulation of guest account settings in HPE Aruba ClearPass Policy Manager's (CPPM) web-based management interface allows remote attackers to extend guest network access beyond enforced policy limits. The flaw resides in the guest account management service and requires no credentials, no user interaction, and no special network position - only HTTP reachability to the management interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires unauthenticated HTTP or HTTPS network access to the CPPM web-based management interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium rating reflects constrained impact: only integrity is affected (I:L), with no confidentiality or availability consequence recorded. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HPE security bulletin hpesbnw05130en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05130en_us&docLocale=en_US) for patch version and upgrade instructions, as no specific fixed version is enumerated in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today