ClearPass OnGuard CVE-2026-76751

Exploitation targets endpoints running the ClearPass Policy Manager OnGuard agent and abuses the agent's failure to verify the integrity/authenticity of content it processes. The realistic practical precondition is an attacker able to intercept, modify, or impersonate the data/update channel the agent trusts (adversary-in-the-middle or a rogue/compromised server), allowing delivery of an unverified malicious payload that then runs with the agent's elevated privileges. Limiting factors: the attacker must be able to reach and influence that trusted channel, and the target must have the OnGuard agent deployed and active; no user interaction or authentication is required per the vendor vector (PR:N/UI:N).

All vendor-provided signals point to high severity: CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes an unauthenticated, network-reachable, low-complexity path to full confidentiality/integrity/availability compromise on the endpoint running the OnGuard agent. However, several decision signals are MISSING from the input: there is no EPSS probability, no CISA KEV entry, no SSVC decision data, and no public POC - so exploitation status is 'no public exploit identified at time of analysis.' A key tension exists between the CVSS vector and the vulnerability class: 'missing integrity verification' flaws typically require an adversary-in-the-middle or malicious-server position to deliver the unverified payload, which usually raises attack complexity (AC:H) rather than the AC:L the vendor assigned - verify the precise trigger with HPE bulletin hpesbnw05158en_us. Net: this is a genuine high-priority patching item for ClearPass OnGuard-managed fleets given the RCE-with-elevated-privileges impact, but the absence of EPSS/KEV/POC evidence means there is currently no indication of active or widespread exploitation, so it is a 'patch promptly' item rather than an 'emergency, under attack' item.

An attacker positioned to intercept or impersonate the server/content that the ClearPass OnGuard endpoint agent trusts delivers a malicious payload that the agent fails to integrity-check before processing. Because the agent runs with elevated privileges, the unverified code executes at high privilege on the endpoint, giving the attacker control of the managed host. No public exploit code has been identified at the time of analysis.