ClearPass Client EUVD-2026-93899

Exploitation requires an interactive low-privileged local session on a system running the Aruba/HPE ClearPass client software (PR:L, AV:L), plus user interaction (UI:R), plus a specific environmental precondition that the description explicitly states is 'outside of the attacker's control' - consistent with a race condition or a particular runtime/configuration state during a privileged client operation (AC:H). These factors sharply limit realistic exploitation: an attacker cannot deterministically force the condition, cannot exploit remotely, and must already possess local account access, so there is no unauthenticated or network-based path. The exact feature or configuration that creates the window is not disclosed in the available data.

This is a moderate-severity local privilege escalation (CVSS 6.7) in the Aruba/HPE ClearPass client software whose real-world risk is meaningfully bounded by its exploitation prerequisites rather than inflated by them. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:R) requires a local foothold, an already-authenticated low-privileged user, user interaction, AND high attack complexity - the description's phrase 'if certain conditions outside of the attacker's control are met' is the direct justification for AC:H and signals a race-condition or environment-dependent trigger that cannot be reliably forced by the attacker. Impact if successful is high across confidentiality, integrity, and availability (C:H/I:H/A:H), i.e. full code execution with elevated privileges. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input: exploitation status is therefore 'no public exploit identified at time of analysis'. The absence of KEV/EPSS combined with AC:H and the non-attacker-controlled precondition indicates this is a defense-in-depth patch priority (not an emergency), appropriately ranked below any network-reachable or unauthenticated flaw. There are no conflicting signals in the data - the only caveat is that EPSS/KEV/POC telemetry is entirely missing, so the likelihood estimate rests solely on the CVSS vector and vendor description.

A low-privileged user (or malware already running in that user's context) on an endpoint running the ClearPass client waits for or induces a specific environmental condition, then triggers the flaw during a privileged client operation to run arbitrary commands at the elevated privilege level. Because success depends on conditions outside the attacker's control and requires user interaction, exploitation is opportunistic rather than reliable. No public exploit code is identified in the provided data.