EUVD-2026-93880
GHSA-62qp-w4gp-5m8w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ClearPass service interface over network
-
DeliverySend input with format specifiers
-
ExploitCorrupt process memory via format string
-
ExecutionHijack control flow
-
ImpactExecute arbitrary code on appliance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Format string safety
|
| Exploitation Conditions | Exploitation requires network reachability to the specific affected ClearPass Policy Manager service interface that processes attacker-controlled input through a format string; per AV:N/AC:L/PR:N/UI:N it needs no authentication, no user interaction, and works against the service as exposed by default. The primary limiting factor is network exposure: ClearPass management/service interfaces are typically on restricted or segmented networks, so organizations that firewall the appliance's service interfaces from untrusted networks materially reduce reachability. The provided data does not state whether a non-default feature or configuration mode is required, so the exact exposed interface should be confirmed against HPE advisory hpesbnw05158en_us. |
| Impact | This is a genuine high-priority issue, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the most dangerous possible profile: network-reachable, low-complexity, no privileges, and no user interaction, yielding full High/High/High impact and a 9.8 base score. The flaw is a format string vulnerability (functionally CWE-134, though the input lists CWE as N/A) leading to memory corruption and arbitrary code execution on a network access control appliance - a security-critical control plane. Weighing the signals against each other: the CVSS is maximal, but several corroborating exploitation signals are absent from the input - no EPSS probability was provided, the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis. SSVC inputs (exploitation status, automatability, technical impact) were not supplied and must be inferred: technical impact is 'total' given RCE, and such a format-string RCE against an unauthenticated network interface would plausibly be automatable, but 'exploitation' should be scored 'none' absent KEV/POC evidence. Net: treat as urgent-patch based on the pre-conditions for exploitation being trivial, while explicitly noting that real-world weaponization is not yet confirmed by any exploitation-maturity signal in the provided data. |
| Exploit ScenarioDerived | A remote attacker with network reachability to the ClearPass Policy Manager service interface sends crafted input containing format string specifiers to the vulnerable service, corrupting process memory. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed, and controlled memory corruption is leveraged to execute arbitrary code on the appliance. No public exploit code is referenced in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated remote code execution is the exposure created by a format string flaw in a service interface of HPE Networking ClearPass Policy Manager: an attacker who can reach the vulnerable interface can supply crafted input that corrupts process memory and, on successful exploitation, execute arbitrary code in the context of the affected service, with high confidentiality, integrity and availability impact (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation is identified at the time of analysis, and the report originates from HPE's own security-alert address, but the absence of authentication, user interaction or attack complexity means exploitation is straightforward for any attacker with network reachability to the interface. The practical limiting factor is exposure: ClearPass management and service interfaces are normally confined to segmented management networks, so internet-facing or user-network-reachable deployments carry the greatest immediate risk.
RemediationAI
No vendor-released patch, fixed firmware version or upgrade build is identified in the available intelligence, so the first action is to retrieve HPE security bulletin hpesbnw05158en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US) and apply the corrected ClearPass Policy Manager release it specifies as soon as it is available; absence of patch data here is not confirmation that no fix exists. Until a fix is applied, the effective control is reducing reachability to the affected service interface: enforce firewall and ACL rules so that only required authentication traffic (for example RADIUS 1812/1813 or TACACS+ from known network access devices) reaches the appliance, and block administrative web, API and management interfaces from user, guest, VPN and internet segments - the trade-off is that overly broad blocking can break guest/BYOD onboarding, NAD authentication or remote administration, so scope rules per interface and validate with a pilot group. Disable or unbind any service interface or feature that is not actively required, since unused listeners enlarge the attack surface, and place the appliance on a dedicated management VLAN with jump-host-only administrative access, accepting the added operational friction. Enable logging and alerting for unexpected service crashes or restarts, which are a common side effect of format-string probing, and where available deploy WAF/IPS signatures that drop requests containing suspicious format specifiers, recognising that such signatures are bypassable and are a stopgap rather than a substitute for the vendor fix. Inventory and continuously monitor ClearPass versions so the patched build can be deployed promptly once published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a format string vulnerability - the class described by CWE-134, Use of Externally-Controlled Format String - in which an affected service interface passes attacker-controlled data directly as the format argument to a printf-family function instead of as a parameter to a fixed format. Attacker-supplied conversion specifiers are then interpreted as instructions: %s and %x can leak stack and memory contents, while %n writes a controlled value to an address chosen via positional parameters, giving a reliable primitive for overwriting return addresses, function pointers or GOT entries and pivoting to arbitrary code execution within the service process. ClearPass Policy Manager is HPE Networking's network access control and policy platform, acting as the RADIUS, TACACS+, 802.1X and guest/BYOD policy engine for enterprise networks, and it exposes multiple service interfaces (administrative web/GUI, REST API, command-line and enforcement/authentication endpoints). The assessed vector AV:N/AC:L/PR:N/UI:N/SU together with the description indicates the vulnerable interface is reachable over the network and processes unauthenticated input, so no credentials or user interaction are required. The source data does not include CPE strings, a mapped CWE identifier or the specific interface name, so the exact affected endpoint and any dependency on a non-default configuration or enabled feature should be confirmed against HPE advisory hpesbnw05158en_us. Standard memory-safety hardening (ASLR, NX/DEP, compiler format-string warnings such as -Wformat-security and FORTIFY_SOURCE) can raise the difficulty of converting the memory corruption into reliable code execution but does not remove the underlying defect.
Know when Hpe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable format string with no user interaction gives AV:N/AC:L/PR:N/UI:N, and arbitrary code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an attacker to execute arbitrary code.
Executive ViewAI
An unauthenticated remote code execution flaw in HPE Networking ClearPass Policy Manager (CVE-2026-76753, CVSS 9.8) would let an attacker who can reach the vulnerable service interface execute arbitrary code in the context of the affected service. Because ClearPass is the control point that authenticates users, devices and guests onto the corporate network, a successful compromise could allow an adversary to bypass network access controls, extract identity and credential data, and use the appliance as a foothold for lateral movement into the environment. No public exploit identified at time of analysis and no vendor patch is available, so risk must be managed through network isolation and monitoring until HPE releases a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict network segmentation so the ClearPass management and service interfaces are reachable only from dedicated administrative hosts on an isolated management VLAN; block internet and user-network reachability via firewall/ACL rules at both network and host level; restrict and monitor administrative access with multi-factor authentication; deploy IDS/IPS signatures for format-string and memory-corruption attempts against the service; enable verbose logging with alerting on anomalous input; rotate service and administrative credentials; and maintain verified, restorable configuration backups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S
A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
NTP through 4.2.8p12 has a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenti
Remote authentication bypass in HPE AutoPass License Server (APLS) allows unauthenticated network attackers to circumven
Unauthenticated remote code execution affects HPE Networking EdgeConnect SD-WAN Gateways running firmware in the 9.4.x,
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8
Exploit-DB