ClearPass OnGuard EUVD-2026-93898

Exploitation requires local access to a host running the HPE ClearPass OnGuard agent plus a valid low-privilege authenticated session (PR:L), with no user interaction needed (UI:N). Limiting factors are significant: the flaw cannot be reached over the network (AV:L), so an attacker must already have a foothold or interactive login on the endpoint, and impact is restricted to interrupting the OnGuard agent service on that single host rather than the ClearPass Policy Manager server itself. The description does not name a specific non-default feature or configuration prerequisite, so the condition is presence of the OnGuard agent and local authenticated access.

This is a moderate-severity, local denial-of-service issue that should be triaged as routine patching rather than an emergency. The vendor-supplied CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, base 6.1) is internally consistent with the description: exploitation requires local access and some level of authentication (PR:L) to interrupt the OnGuard agent service, with high availability impact and no confidentiality impact. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' All signals point the same direction - low real-world urgency: the local attack vector (AV:L) and authentication requirement (PR:L) sharply limit who can trigger it, and the impact is confined to availability of a single endpoint agent, not code execution or data exposure. One minor inconsistency to verify: the vendor vector lists I:L (low integrity impact) even though the description characterizes the flaw purely as service interruption/DoS; a pure DoS would normally be C:N/I:N/A:H, so the integrity bit is either a conservative rounding by HPE or reflects a secondary effect not detailed in the summary - confirm with the HPE advisory. This is a high-CVSS-relative-to-real-risk scenario where the base score overstates practical danger because it is a locally-scoped, authenticated DoS.

An attacker who already has authenticated local access to an endpoint running the HPE ClearPass OnGuard agent (for example a standard logged-in user or a user who has compromised a low-privilege account) triggers the flaw to crash or hang the agent service, disrupting posture assessment and network-access health checks on that host. No public exploit code is identified, and the local, authenticated prerequisite (AV:L/PR:L) means this cannot be driven remotely or at scale.