EUVD-2026-93903
GHSA-fh9m-r2cx-fj58
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-priv access to host
-
DeliveryInteract with ClearPass client software
-
ExploitTrigger information disclosure flaw
-
ExecutionRead sensitive data from client
-
ImpactUse disclosed data for further access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to the system running the HPE Networking ClearPass Policy Manager client software, plus an existing low-privilege account or session on that host (CVSS PR:L). No user interaction is needed (UI:N). The flaw cannot be triggered remotely or by an unauthenticated actor, which is the primary limiting factor: an attacker must already be present on the target host with some privilege. The exact client feature, configuration, or stored data that leaks sensitive information is not detailed in the available description or the (unretrieved) vendor advisory, so the specific triggering condition could not be confirmed. |
| Impact | This is a moderate, locally-exploitable information disclosure issue that does not rise to patch-now urgency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is internally consistent with the description: exploitation requires local access to the affected client system and some existing low-level privilege (PR:L), limiting the attacker population to users who already have a foothold on the host. The high confidentiality impact (C:H) with no integrity or availability impact matches a pure sensitive-information-disclosure flaw. No EPSS score, SSVC decision, or KEV listing was provided, and there is no indication of public exploit code, so there is no evidence of active or widespread exploitation (no public exploit identified at time of analysis). The combination of local-only vector, required privileges, and absence of exploitation signals means this is a genuine but lower-priority issue - best handled in normal patch cycles after internet-facing and remotely-exploitable flaws. Note: the vendor advisory (HPE hpesbnw05158en_us) was not retrievable in this analysis, so affected versions, fix versions, and the exact nature of the disclosed information could not be independently confirmed. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged local account or session on a system running the HPE Networking ClearPass Policy Manager client software leverages the flaw to read sensitive information the client stores or processes (e.g., credentials, configuration, or policy data). Because the vector is local and requires existing privileges with no user interaction, this is most relevant as a privilege-escalation-adjacent or lateral-movement aid rather than a remote entry point. No public proof-of-concept was provided in the source data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Information disclosure in the HPE Networking ClearPass Policy Manager client software allows a locally positioned attacker holding a low-privilege account or session on the host to read sensitive information that the client handles or stores. The flaw is constrained by its access prerequisites: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms that exploitation requires local presence with some existing privilege, cannot be triggered remotely or by an unauthenticated actor, and needs no user interaction, while integrity and availability are unaffected and only confidentiality is impacted. Exploitation is rated moderate (CVSS 5.5), no public exploit code has been identified at time of analysis, and there is no evidence of confirmed active exploitation (no CISA KEV listing), so the practical risk is dominated by the need for an attacker to already be resident on the target machine with a valid low-privileged foothold; this is not a remote, unauthenticated compromise vector.
RemediationAI
Patch availability is not specified in the available data, so patch status should be treated as unconfirmed and verified directly against the HPE advisory (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US), which is the only reference supplied and the authoritative source for fixed client builds; apply the vendor-specified client update as soon as it is identified, and do not deploy an assumed version number that is not stated in that bulletin. Until a fixed client build is confirmed, the realistic mitigations are all boundary-reduction measures, since the vulnerability cannot be reached remotely. First, strictly limit who can log on interactively to hosts running the ClearPass Policy Manager client, remove or disable unnecessary local accounts, and ensure the client is not installed on broadly shared or multi-user workstations - the trade-off is reduced administrative convenience and potential loss of legitimate multi-admin workflows. Second, revoke or minimize standing privileges for accounts that do exist on those hosts, since exploitation needs only a low-privilege session; this shrinks the pool of attackers who satisfy the PR:L prerequisite but does not eliminate the flaw. Third, apply application allowlisting and endpoint detection/monitoring so that unexpected processes reading the client's files, memory, or data directories generate alerts, accepting the operational overhead of tuning false positives. Fourth, review what secrets the client caches or stores locally and rotate credentials, tokens, and shared secrets it may expose, on the assumption that any host with a compromised low-privileged account should be considered to have leaked that material. Finally, note that network segmentation, remote-access hardening, and perimeter controls do not mitigate this issue in any meaningful way, because the attack path is entirely local; effort is better spent on host-level privilege reduction and monitoring.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ClearPass Policy Manager is HPE Networking's network access control (NAC) and policy enforcement platform, which authenticates and authorizes devices and users across wired, wireless, and VPN infrastructure; the affected component here is the client-side software that runs on endpoints or administrative workstations rather than the central policy server. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N places the defect firmly in the local privilege-boundary class: an attacker must already hold an account on the host (PR:L), the attack is low complexity once present, no interaction from a legitimate user is needed, and the scope remains unchanged so no escape to other components is implied. The high confidentiality impact with no integrity or availability effect indicates a read-out of data the client can access but should not hand to an unprivileged local user - typically credentials, session tokens, cached policy or authentication data, or configuration material held in memory or on disk. No CWE is assigned in the supplied data, so the precise root-cause class (for example exposure through file permissions, insecure storage of credentials, log or cache leakage, or an over-permissive client interface) cannot be confirmed from available intelligence, and no CPE strings were supplied to pin down exact build numbers. The single reference provided is the HPE security bulletin hpesbnw05158en_us, which was not retrievable in this dataset; the exact client feature, data store, or configuration state that leaks information therefore remains unverified.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local client-side disclosure requiring an existing low-privilege session yields AV:L and PR:L; pure information disclosure gives C:H with I:N/A:N.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A sensitive information disclosure vulnerability exists in the client software of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an attacker with local access to the affected system to obtain sensitive information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB