EUVD-2026-93879
GHSA-m7g4-2j92-rmph
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ClearPass management/API interface
-
DeliverySend crafted authentication-bypass request
-
ExploitCircumvent authentication controls
-
ExecutionObtain administrative session
-
ImpactAlter NAC/RADIUS policy and pivot into network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the ClearPass Policy Manager web-based management interface or its API interface - the two attack surfaces named in the description. Per the CVSS vector (PR:N/UI:N/AC:L), no credentials, no user interaction, and no special non-default configuration are stated as prerequisites, so default-exposed management/API endpoints are sufficient. The primary LIMITING factor is exposure: ClearPass management/API interfaces are often restricted to management VLANs or admin networks, so organizations that do not expose these interfaces to broad or internet-facing segments materially reduce the realistic attack surface. No specific feature-enablement or deployment mode is cited as a condition in the available data. |
| Impact | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exposure profile: network-reachable, low attack complexity, no privileges, and no user interaction, yielding full H/H/H impact because success grants administrative access to the policy engine that governs network access control. ClearPass Policy Manager is typically positioned as a security chokepoint (RADIUS/NAC, 802.1X, guest and device onboarding), so administrative compromise has outsized blast radius across the enterprise network, not just the appliance. Several key signals are MISSING and should be stated explicitly: no EPSS score was provided, so exploitation probability cannot be quantified; KEV status is not indicated in the input, so there is NO confirmation of active exploitation; and no POC is referenced, so public exploit availability is unconfirmed. The CVSS vector is internally consistent with the description ('unauthenticated remote attacker ... circumvent existing authentication controls'), so there is no network-vs-local conflict to flag. Bottom line: treat as critical and patch urgently given the unauthenticated-remote-to-admin profile on a security-infrastructure appliance, while recognizing that real-world exploitation signals (EPSS/KEV/POC) are currently absent rather than negative. |
| Exploit ScenarioDerived | An attacker with network reachability to the ClearPass web-based management or API interface sends crafted requests that bypass the authentication layer, obtaining an administrative session without any valid credentials. Because the vector is AV:N/AC:L/PR:N/UI:N, this requires only connectivity to the interface and no user interaction. No public exploit is identified at time of analysis, but the low complexity and unauthenticated nature make reliable exploitation plausible once details or tooling emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Authentication bypass in HPE Networking ClearPass Policy Manager allows an unauthenticated remote attacker to circumvent existing authentication controls on the product's web-based management and API interfaces and obtain administrative access to the affected system. The flaw carries a vendor-assessed CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction, and no special configuration are required - only network reachability to a management or API endpoint, which in many deployments is restricted to management VLANs or admin networks, making exposure control the primary practical limiting factor. Our assessment rates this a genuine top-priority vulnerability rather than a high-CVSS-but-low-real-risk case; no public exploit code and no confirmed active exploitation were identified at time of analysis, and ClearPass is a network access control / policy enforcement platform, so administrative compromise can extend impact well beyond the appliance itself.
RemediationAI
No vendor-released patch version is identified in the available data, so the first action is to retrieve the version and fix matrix directly from the HPE advisory (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US) and apply the vendor-designated ClearPass update as soon as it is confirmed for your branch; treat any interim guidance in that document as authoritative over generic advice. Until a fix is applied, the highest-value control is exposure reduction, because the vulnerability requires only network reachability to the management console or API (PR:N/UI:N/AC:L): restrict TCP/443 access to defined administrative jump hosts or a dedicated management VLAN with explicit deny-all egress to the appliance, and remove any internet-facing or broadly routed management/API exposure - the trade-off is that remote administrators must use the jump host or VPN, and forgotten NAT or firewall exceptions will silently negate the control. Additional compensating measures include segmenting ClearPass from general user and guest networks, tightening API access by disabling unused API clients or restricting them by source address where the product permits, and applying infrastructure ACLs on the surrounding switches and firewalls; these reduce but do not eliminate risk since they are defense-in-depth rather than a fix. Because successful exploitation yields administrative access, also hunt for post-exploitation indicators by reviewing ClearPass audit and access logs for anomalous authentication events, unexpected admin sessions, or configuration changes, and rotate administrative credentials, API client secrets, and integration secrets for Active Directory, network devices (RADIUS/TACACS+ shared secrets), and certificate stores once the environment is confirmed clean or patched; note that credential rotation will interrupt integrations if performed without coordinating dependent systems, so stage it during a maintenance window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ClearPass Policy Manager is HPE Networking's (formerly Aruba) network access control and AAA platform, centralizing RADIUS/TACACS+ authentication, role-based authorization, endpoint profiling, and guest/onboarding policy decisions for enterprise networks. The affected attack surface is specifically the two interfaces named in the vendor description: the HTTPS web-based management console and the REST API. The vulnerability is an authentication bypass (matching the advisory tag "Authentication Bypass"), meaning the authentication logic protecting those interfaces can be circumvented rather than being a memory-safety, injection, or cryptographic weakness - no CWE identifier was supplied in the available data, so the precise root-cause class (for example improper authentication, missing authentication for a critical function, or forced-browsing/alternate-path bypass) cannot be confirmed from the sources provided. The CVSS metrics AV:N/AC:L/PR:N/UI:N indicate the flaw is network-reachable with low complexity and requires neither prior credentials nor victim interaction, consistent with an attacker directly reaching an exposed management or API endpoint and being granted administrative context. Because ClearPass brokers authentication and authorization decisions for downstream network infrastructure, administrative access to it exposes policy configuration, integration credentials with directories and network devices, and enforcement logic - consistent with the high confidentiality, integrity, and availability impact of the assessed vector.
Know when Hpe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated remote attacker bypasses authentication to gain administrative access over network-facing management/API interfaces, so AV:N/AC:L/PR:N/UI:N with full C/I/A.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authentication controls and gain administrative access to the affected system.
Executive ViewAI
CVE-2026-76752 is an authentication bypass in HPE Networking ClearPass Policy Manager that would allow an unauthenticated remote attacker to obtain administrative control of the platform our organization depends on to authenticate users and enforce network access policy. Because ClearPass is the control layer deciding who and what may connect to the network, its compromise could be used to grant unauthorized devices and accounts trusted access, weaken segmentation enforcement, and expose downstream systems that assume ClearPass-issued decisions are trustworthy. Leadership should treat this as an enterprise-wide network trust issue rather than a single-appliance incident, particularly since no vendor-released patch is available at this time.
No vendor-released patch identified at time of analysis; interim mitigations are network-based. Restrict all ClearPass web management and API interfaces to dedicated management VLANs or administrator networks and block internet exposure entirely; enforce firewall/ACL allowlists limited to named administrative source addresses; disable or firewall any unused API or external-facing management service; log and monitor administrative sessions, API activity and policy changes for anomalies; and recognize that MFA and credential-based controls do not mitigate this bypass, so exposure reduction and network segmentation are the primary practical defenses until HPE ships a fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S
A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
NTP through 4.2.8p12 has a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
A maximum-severity, network-reachable flaw (CVSS 3.1 base 10.0) in an as-yet-unnamed HPE product allows remote attackers
Unauthenticated network attackers can potentially achieve high confidentiality, integrity, and availability impact again
HPE security bulletin hpesbnw05162en_us documents a maximum-severity (CVSS 10.0) exposure in an HPE product that is not
HPE advisory hpesbnw05162en_us covers a product flaw carrying a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H
Exploit-DB