ClearPass OnGuard EUVD-2026-93892

Exploitation requires the ClearPass Policy Manager OnGuard agent to be installed and running on a Linux client, and the attacker must already possess a local, low-privileged account or equivalent local code-execution on that same host (PR:L, AV:L). No user interaction and no special non-default configuration is indicated by the description beyond having the OnGuard Linux agent deployed. Limiting factors that reduce real-world risk: the attacker cannot exploit this remotely over the network (local vector only), must first establish a foothold on the endpoint, and the issue only affects Linux instances running the OnGuard agent - Windows/macOS clients or hosts without the agent are not in scope per the description.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege escalation requiring an already-authenticated low-privileged user on the affected Linux host, with low attack complexity and no user interaction, yielding full confidentiality, integrity and availability impact (root). This is consistent with the description, which states a malicious local user on a Linux instance can elevate to root via the OnGuard agent. No EPSS score was provided; no CISA KEV listing is present; and no public proof-of-concept was supplied in the intelligence - so this is 'no public exploit identified at time of analysis.' The absence of a network vector materially lowers real-world urgency: this is not a remotely-wormable flaw but a local escalation that presupposes the attacker already has a foothold (valid local account or code execution) on a machine running the OnGuard Linux agent. As a classic local priv-esc in a deployed endpoint agent it is a genuine post-compromise concern for defense-in-depth rather than an internet-facing emergency. Key missing signals: EPSS probability unknown, KEV status not confirmed, and no CWE was assigned, so the exact weakness class (e.g., insecure file permissions, symlink, or SUID/service misuse) cannot be verified from the input.

An attacker who already has an unprivileged shell on a Linux endpoint running the ClearPass OnGuard agent (for example a standard user on a corporate laptop, or an attacker who gained limited code execution) abuses the agent's elevated functionality to run code as root. This converts a low-value local account into full root control of the host. No public exploit code was identified at time of analysis, and no user interaction is required.