ClearPass Policy Manager CVE-2026-79801

Exploitation targets the HPE Networking ClearPass Policy Manager client agent software and abuses its failure to verify the integrity of code it ingests. The concrete prerequisite is that the attacker must be able to supply or substitute the untrusted code the agent consumes - in practice this means a man-in-the-middle position on the agent's communication/update channel or control over a source the agent trusts. Limiting factors: the attacker needs that network positioning or trusted-source access rather than merely reaching the endpoint; impact is confined to systems running the vulnerable client agent (not the ClearPass server), and organizations not deploying the client agent (e.g., OnGuard) are unaffected. Exact affected versions are not provided and should be confirmed against the HPE advisory.

The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) paints a worst-case picture: network-reachable, no privileges, no user interaction, full CIA impact. However, this signal conflicts with the vulnerability class. The flaw is a missing integrity verification ('introduce untrusted code') in the ClearPass client agent, which realistically requires the attacker to occupy a privileged position - e.g., a man-in-the-middle on the agent's download/update channel or control of a server the agent trusts - to actually substitute malicious code. That delivery requirement is not reflected in the AC:L rating, so the 9.8 likely overstates trivial exploitability; I would rate attack complexity higher. EPSS probability is NOT provided, this CVE is NOT on the CISA KEV list, and no public POC is referenced, so there is no public exploit identified at time of analysis. With a 2026 CVE and only a single vendor advisory as backing, this is a genuine high-severity patch priority for organizations running the ClearPass OnGuard/client agent, but the raw 9.8 should be read with the caveat that practical exploitation depends on network positioning rather than a simple unauthenticated packet - verify the exact exploitation path with HPE's advisory.

An attacker positioned on the network path between a ClearPass client agent endpoint and its code/update source intercepts or serves content that the agent fails to integrity-check, substituting an untrusted payload. Because the agent accepts the unverified code, it is executed on the client endpoint, giving the attacker arbitrary code execution. No public POC is referenced in the provided data.