EUVD-2026-93891
GHSA-6f23-w4wq-f8hw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid ClearPass credentials
-
DeliveryReach Policy Manager web interface
-
ExploitSubmit path-traversal request
-
ExecutionRead or modify OS files
-
ImpactHarvest secrets or tamper with config
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session to the ClearPass Policy Manager management interface (the description states 'authenticated'), which is the primary limiting factor despite the CVSS vector's PR:N. The attacker needs network reachability to that web/management interface - appliances with the admin plane restricted to trusted management networks substantially reduce exposure. No end-user interaction is required. The exact privilege level required (any authenticated user vs. an elevated role) is not specified in the available data and should be confirmed with HPE, as it materially changes real-world risk. |
| Impact | Signals conflict sharply and must be reconciled before prioritization. The input CVSS is 9.8 with vector AV:N/AC:L/PR:N/UI:N, but the description explicitly states this is an 'authenticated path traversal' - PR:N (no privileges) directly contradicts the word 'authenticated.' This mislabeling inflates the score: a correctly authenticated flaw (PR:L) would score roughly in the 8.x CVSS range, not 9.8. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation or widespread automated targeting at this time. The realistic risk is a post-authentication read/write primitive on a security-critical NAC appliance: serious for an environment where attackers can obtain valid (even low-privilege) ClearPass credentials, but materially lower than the 9.8 'remote unauthenticated' reading implies. Treat as a high-priority patch for an exposed management plane, but verify the authentication requirement with HPE before treating it as pre-auth RCE-equivalent: 'CVSS vector reports PR:N (unauthenticated) but the description says authenticated - verify privilege requirement with HPE.' |
| Exploit ScenarioDerived | An attacker with valid (possibly low-privilege) credentials to the ClearPass Policy Manager web interface submits a crafted request containing directory-traversal sequences to reach files outside the intended directory, then reads sensitive configuration/credential material or modifies files on the underlying OS. No public exploit code was identified at time of analysis, and the attack is network-reachable but gated by the need for authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Path traversal in HPE Aruba ClearPass Policy Manager allows an authenticated attacker with access to the management interface to read and modify files on the underlying operating system. The independent assessment rates this as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, requiring a valid session and network reachability to the management plane; the vendor's stated vector with PR:N conflicts with the description's authentication prerequisite. No public exploit code or CISA KEV entry is identified at time of analysis.
RemediationAI
Vendor-released patch details are not specified in the provided data; the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US is the authoritative source for exact fixed versions and should be followed. Until a patch is applied, restrict network access to the ClearPass management interface to trusted administrative networks via firewall rules or ACLs, as this removes the primary attack vector but may limit remote administration. Enforce least privilege for authenticated accounts and enable multi-factor authentication where supported, since exploitation requires a valid session. Monitor file integrity on the ClearPass appliance and review logs for anomalous file access or modification attempts. Trade-offs: network restrictions can impede legitimate remote management; MFA may require additional infrastructure. No workaround that fully mitigates the flaw without patching is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ClearPass Policy Manager is a network access control (NAC) appliance from HPE Aruba; its web-based management interface is the attack vector. The flaw is a path traversal (CWE-22 class) where insufficient validation of file path input permits an authenticated user to escape the intended directory and access or modify arbitrary files with the privileges of the ClearPass service. This could expose configuration, credential stores, or allow persistence on the underlying OS. No CPE strings were provided; affected versions are not enumerated in the supplied data, but the HPE advisory hpesbnw05158en_us is the authoritative source. The root cause is likely improper canonicalization or lack of sanitization of user-supplied path parameters in an administrative function.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface (AV:N, AC:L) but description says authenticated, so PR:L not PR:N; file read and modify give C:H/I:H, with no described availability impact (A:N).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the underlying operating system.
Executive ViewAI
A critical path-traversal flaw in HPE Aruba ClearPass Policy Manager could allow an authenticated user with management-interface access to read and modify files on the underlying operating system, threatening the integrity and confidentiality of the platform that governs network access. Because ClearPass is often central to authentication and admission control, a successful attack could disrupt network access, expose sensitive data, or enable persistent unauthorized changes. Leadership should prioritize mitigation even though no public exploit has been identified at time of analysis, as no vendor-released patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting management-interface access to trusted networks and jump hosts, enforcing MFA and least privilege, monitoring file integrity and administrative sessions, segmenting the management plane, disabling unnecessary services, and engaging HPE support for hotfix or mitigation guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB