ClearPass OnGuard EUVD-2026-93894

Requires an authenticated local user already present on a host where the ClearPass Policy Manager OnGuard agent is installed and running; the attacker interacts with the local agent to trigger the buffer overflow. Exploitation is LIMITED by the local attack vector (AV:L) - it cannot be performed remotely over the network - and by the need for at least low-privileged local access (PR:L). It applies to endpoints running the OnGuard agent rather than the ClearPass management appliance itself.

This is a credible but not emergency-level priority. The vendor-supplied CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation / local code-execution flaw: an attacker needs an existing low-privileged local account on a host running the ClearPass OnGuard agent, but given that, exploitation is low-complexity, requires no user interaction, and yields full confidentiality/integrity/availability impact via elevated-privilege code execution. The critical limiter is AV:L - this is NOT remotely reachable, so it cannot be mass-exploited over the network and is better understood as a local escalation primitive chained after an initial foothold. No EPSS score, KEV listing, or POC was provided in the input, so there is no public evidence of active exploitation or available exploit code. Note a tagging/impact tension: the input carries an 'RCE' (remote code execution) tag, but the CVSS vector and description both indicate LOCAL code execution - treat 'remote' claims with caution and rely on the AV:L local-only vector. No SSVC decision data was supplied. Overall: a genuine local EoP worth patching on managed endpoints, but low urgency relative to a network-reachable unauthenticated flaw.

An attacker who already has a low-privileged foothold on a host running the ClearPass OnGuard agent (e.g., a standard user account or malware-dropped session) triggers a buffer overflow in the agent to execute arbitrary code at the agent's elevated privilege level, escalating from user to system-level control. Alternatively the attacker corrupts memory to crash the agent and disrupt NAC posture enforcement. No public exploit code was identified in the provided data, so this would require custom exploit development.