ClearPass OnGuard EUVD-2026-93900

Exploitation requires the attacker to be a local, authenticated user on a system running the ClearPass Policy Manager OnGuard agent (PR:L, AV:L) and requires user interaction (UI:R). Critically, HPE states success depends on 'certain preconditions outside of the attacker's control' being met, and the attack is high-complexity (AC:H), meaning it cannot be triggered on demand against an arbitrary default install - the specific environmental conditions are not enumerated by the vendor. These factors - local access, required interaction, attacker-uncontrolled preconditions, and high complexity - substantially limit real-world exploitability, confining impact to hosts where the OnGuard agent is deployed and the unspecified preconditions already exist.

This is a moderate, defense-in-depth-tier issue rather than an urgent emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:R) confirms three independent brakes on exploitation: the attacker must already be a local, authenticated user on the host running the ClearPass OnGuard agent (PR:L), the attack is high-complexity (AC:H) because, per the HPE description, 'certain preconditions outside of the attacker's control' must be met, and user interaction is required (UI:R). The scope is unchanged (S:U) but impact is high across confidentiality, integrity, and availability (C:H/I:H/A:H) because success yields arbitrary code execution with elevated privileges - a full local privilege escalation. No EPSS score, CISA KEV listing, or SSVC decision point was provided in the input, and no public exploit code is referenced, so there is no public exploit identified at time of analysis; the 'RCE' tag reflects the local code-execution outcome, not remote reachability. Weighing the signals: the high impact is offset by local access, high attack complexity, and attacker-uncontrolled preconditions, which is why the vendor base score lands at 6.7 (Medium) rather than Critical. Treat this as a patch-in-normal-cycle privilege-escalation bug unless telemetry shows local attacker presence on ClearPass-managed endpoints. Note that no EPSS or KEV data was supplied, so widespread-exploitation likelihood cannot be quantified from the provided intelligence.

A local user already logged into a system running the ClearPass OnGuard agent abuses the arbitrary file write flaw to plant or overwrite a file that is later executed in a higher-privilege context, gaining elevated code execution. Exploitation only succeeds when environment-specific preconditions outside the attacker's control are already present and typically requires user interaction, so it is opportunistic rather than reliable. No public exploit code is referenced in the available intelligence.