EUVD-2026-93901
GHSA-5mfp-rqmh-c9ff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to ClearPass-managed environment
-
DeliverySubmit crafted input to OnGuard agent
-
ExploitInject commands via unsanitized parameter
-
ExecutionExecute arbitrary commands with elevated privileges
-
ImpactCompromise Windows endpoint
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching and interacting with the ClearPass Policy Manager OnGuard agent and, per the vulnerability description, an authenticated remote attacker - so a valid authenticated session/context within the ClearPass-managed environment is a prerequisite despite the input vector showing PR:N. The affected component is the OnGuard posture/health agent deployed on Windows endpoints, so only environments that have deployed the OnGuard agent on Windows hosts are exposed; non-Windows endpoints and deployments not using the OnGuard agent are not in scope. The primary limiting factor is the authentication requirement; the primary aggravating factor is that successful injection runs with elevated privileges, giving outsized impact once the auth barrier is crossed. |
| Impact | This is a medium-severity (CVSS 6.5) command injection in the HPE Aruba ClearPass Policy Manager OnGuard agent. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity attack with no privileges required, which on paper suggests easy exploitation. However, this directly CONFLICTS with the vulnerability description, which explicitly states an 'authenticated remote attacker' is required - verify the true privilege requirement with HPE advisory hpesbnw05158en_us, as PR:N appears incorrect. The scored impact (C:N/I:L/A:L) also appears understated relative to the description, which says exploitation yields command execution 'with elevated privileges' on the Windows endpoint - that is consistent with full endpoint compromise, not merely low integrity/availability impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no evidence of active exploitation or weaponization; this reads as a real but not emergency priority. The combination of an authentication requirement and elevated-privilege command execution makes this most relevant as a post-authentication privilege/endpoint-compromise vector in environments running ClearPass OnGuard, rather than a mass-exploitable internet-facing bug. |
| Exploit ScenarioDerived | An attacker who has authenticated access in a ClearPass-managed environment supplies crafted input to the OnGuard agent that is not properly sanitized before being passed to a system command, injecting arbitrary commands. Those commands execute with elevated privileges on the targeted Windows endpoint, enabling local compromise of the host. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Command injection in the HPE Aruba ClearPass Policy Manager OnGuard agent allows an attacker holding a valid authenticated session within a ClearPass-managed environment to inject and execute arbitrary operating-system commands, which per the vulnerability description run with elevated privileges on the affected Windows endpoint. Only deployments that have installed the OnGuard posture/health agent on Windows hosts are exposed; non-Windows endpoints and environments not using OnGuard are out of scope. HPE rates this medium severity (CVSS 6.5), and our independent assessment keeps the severity in that band while noting that, once the authentication prerequisite is satisfied, the impact on the endpoint is high because the injected commands inherit elevated rights (assessed confidentiality, integrity and availability all High). No public exploit code has been identified and CISA KEV does not list this issue, so there is no confirmation of active exploitation at time of analysis.
RemediationAI
No vendor-released patch is identified in the provided intelligence, so the first action is to retrieve the HPE Security Bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US and confirm whether a fixed OnGuard agent build is published; if one is, upgrade all Windows endpoints to that exact build and re-verify agent version reporting from ClearPass Policy Manager. Until a patched build is confirmed, apply compensating controls that map to the actual exposure: restrict network reachability to the OnGuard agent so that only ClearPass Policy Manager servers and the internal management VLAN can contact it, blocking agent ports from user and guest networks - this sharply reduces the attack surface but adds firewall and routing management overhead and can break posture checks for remote or VPN-only clients if done too broadly. Tighten authentication and authorisation in the ClearPass-managed environment, since a valid authenticated session is the documented prerequisite: enforce MFA for all administrative and operator accounts, remove shared credentials, and audit accounts that can trigger agent interaction - the trade-off is reduced convenience for helpdesk and operations staff. Reduce the agent's effective privilege where the Windows build allows it, and monitor for unexpected child-process creation, service-level command execution, and anomalous process trees on OnGuard-managed hosts; detection coverage is a compensating rather than preventive measure and will only catch exploitation attempts that generate observable process activity. Finally, treat hosts that ran an unpatched OnGuard agent as potentially compromised and rebuild them rather than relying on cleanup alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the OnGuard agent, the endpoint posture and health assessment client that ClearPass Policy Manager deploys onto managed endpoints (in this case Windows hosts) to collect device state and enforce policy decisions. Command injection flaws arise when externally influenced input is passed into a shell or process-spawning API without adequate neutralisation, so attacker-controlled data is interpreted as operating-system commands rather than as inert data (the OS command injection class, CWE-78; the source record supplies no CWE value, so this classification is inferred from the reported vulnerability type). The practical risk here is amplified by the agent's privilege level: OnGuard agents typically run as a Windows service or system-level process to read posture telemetry, so commands executed through the injection can inherit elevated rights rather than those of the low-privileged caller. Note a signal conflict in the supplied data: the input CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L (6.5), while the description explicitly requires an authenticated remote attacker and our assessment uses AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The authoritative assessment therefore treats authentication as a genuine prerequisite and rates the post-authentication impact as high, rather than the limited-integrity impact implied by the input vector. No CPE identifiers were provided, so product scoping rests on the vendor advisory and the description.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Description requires an authenticated attacker so PR:L (not PR:N), and command execution with elevated privileges yields full endpoint compromise, so C:H/I:H/A:H rather than the understated L/L.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary commands. Successful exploitation could allow an attacker to execute commands with elevated privileges on the affected Windows endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB