EUVD-2026-93883
GHSA-7wf7-w5jj-hhjq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ClearPass interface over network
-
DeliverySend crafted auth-bypass request
-
ExploitCircumvent authentication controls
-
ExecutionGain unauthorized system access
-
ImpactAbuse NAC policy control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the ClearPass Policy Manager 'affected interface' (the bulletin does not name the specific service/port, so defenders should confirm which management or web interface is exposed). Per the CVSS vector (PR:N/UI:N/AC:L), no credentials, no user interaction, and no special configuration are stated as prerequisites, implying default-configuration exploitability. The primary limiting factor is exposure: ClearPass management interfaces are typically intended to be on restricted management networks, so organizations that do not expose the affected interface to untrusted networks substantially reduce realistic risk. Exact affected versions are not provided and must be obtained from the HPE bulletin. |
| Impact | All available signals point to this being a genuine high priority rather than a CVSS-inflated non-issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, which for an authentication-bypass flaw in a network access control appliance is the most dangerous possible combination. The claimed impact is full compromise (C:H/I:H/A:H) consistent with 'unauthorized access to the affected system.' However, several decision-support signals are ABSENT from the provided data: there is no EPSS exploitation-probability score, no CISA KEV listing, no SSVC decision values, and no POC indicator - so exploitation likelihood cannot be quantified and must be inferred from the vector alone. There is also no CWE assigned (CWE: N/A) and the description is deliberately vague ('the affected interface' is never named), so the exact bypass mechanism is unverified. Treat this as high-priority to patch based on vector and vendor severity, but note that the real-world exploitation signal (EPSS/KEV/POC) is simply missing rather than confirmed low. |
| Exploit ScenarioDerived | A remote attacker with network reachability to the ClearPass Policy Manager interface sends crafted requests that circumvent the authentication controls, obtaining unauthorized access without any credentials or user interaction. Because ClearPass is a network access control hub, that access could be leveraged to view or alter policy and gain a foothold into enrollment and authentication decisions. No public exploit was identified in the provided data, so this scenario is derived from the CVSS vector (AV:N/AC:L/PR:N) rather than an observed exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Authentication bypass in HPE Aruba Networking ClearPass Policy Manager allows an unauthenticated remote attacker to circumvent existing authentication controls on the affected interface and gain unauthorized access to the system, rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified and the vulnerability is not confirmed actively exploited (no CISA KEV), but the assessed vector shows no credentials, no user interaction and no special configuration required, implying default-configuration exploitability where the interface is reachable. Independent assessment concludes the available signals point to a genuine high-priority issue rather than a CVSS-inflated non-issue; the exact affected versions and the specific exposed service are not named in the available HPE bulletin, so exposure of the interface is the primary risk-limiting factor.
RemediationAI
Patch status is not confirmed by the provided data - no fix version, patch reference, or availability statement was supplied - so the authoritative action is to pull the referenced HPE security bulletin (hpesbnw05158en_us at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US) and apply the vendor-designated fixed release for the affected ClearPass Policy Manager branch; do not upgrade blindly to an unnamed build. Until a fix is installed, the highest-value compensating control is exposure reduction: firewall or ACL the ClearPass management and API interfaces so they are reachable only from a dedicated management VLAN, jump host, or VPN pool, and confirm whether the as-yet-unnamed 'affected interface' is actually reachable from untrusted networks - the trade-off is that legitimate integrations (endpoint profiling, guest portals, external SIEM or MDM service accounts) that call the API from other subnets will break unless their source addresses are explicitly allowlisted. Disable or bind-to-localhost any management service not actively in use, and review authentication logs for successful administrative sessions lacking a corresponding credential event, since a bypass leaves no failed-login trail; note that this is detective-only and cannot stop exploitation. Because ClearPass is itself the authentication authority for the network, a compromise also undermines downstream 802.1X/RADIUS trust, so rotate any secrets, shared RADIUS/TACACS+ keys and API credentials held on the appliance once a patch is applied, accepting the operational disruption of re-keying network devices.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ClearPass Policy Manager is HPE Aruba Networking's network access control (NAC) platform, handling RADIUS/TACACS+ authentication and authorization, 802.1X and MAC-based access control, guest onboarding, device profiling and posture checks. The vulnerability sits in what the vendor calls an 'affected interface' - the bulletin does not identify the specific service, port, or endpoint (web administration UI, REST API, or a management service), leaving defenders to enumerate what is exposed. No CWE identifier was supplied; the reported tag 'Authentication Bypass' places the root cause in the improper-authentication/authorization-control family (the CWE-287 lineage), where an attacker-supplied request reaches protected functionality without a valid credential check. Because the CVSS vector is PR:N/UI:N/AC:L/S:U with High confidentiality, integrity and availability impact, exploitation is conceptually a single unauthenticated request against a reachable interface yielding full administrative control of the policy engine. No CPE strings or vendor version coordinates were included in the provided data, so precise affected builds cannot be enumerated from this feed and must be taken from the HPE advisory.
Know when Hpe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
An unauthenticated network-reachable authentication bypass yielding unauthorized access justifies AV:N/AC:L/PR:N/UI:N, and full system access on a policy appliance supports C:H/I:H/A:H.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.
Executive ViewAI
HPE Aruba Networking ClearPass Policy Manager, a central policy and network access control platform, is affected by a critical authentication bypass that an unauthenticated remote attacker could use to gain high-impact access if the vulnerable interface is reachable. Because no vendor-released patch is identified and no public exploit identified at time of analysis, leadership should prioritize reducing exposure and confirming asset inventory, as affected ClearPass deployments support authentication and access decisions for employees, guests, and devices across the enterprise.
No vendor-released patch identified at time of analysis; interim mitigations include restricting the affected interface to trusted management networks via firewall rules, ACLs, and network segmentation, disabling or limiting exposure of the vulnerable service if not business-essential, enforcing MFA and least privilege for administrative access, monitoring ClearPass logs for authentication bypass or unauthorized policy changes, and engaging HPE support for version-specific workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S
A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
NTP through 4.2.8p12 has a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
A maximum-severity, network-reachable flaw (CVSS 3.1 base 10.0) in an as-yet-unnamed HPE product allows remote attackers
Unauthenticated network attackers can potentially achieve high confidentiality, integrity, and availability impact again
HPE security bulletin hpesbnw05162en_us documents a maximum-severity (CVSS 10.0) exposure in an HPE product that is not
HPE advisory hpesbnw05162en_us covers a product flaw carrying a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H
Exploit-DB