EUVD-2026-93904
GHSA-cr9w-rx83-m757
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ClearPass API over network
-
ExploitSend crafted API request
-
ExecutionBypass authentication control
-
ImpactRetrieve sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the ClearPass Policy Manager API interface; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, elevated privileges, or user interaction are needed, and the flaw targets an authentication-control weakness on an API endpoint rather than a non-default feature toggle. The primary limiting factor is exposure of the management/API interface - ClearPass admin and API interfaces are typically segmented on management networks, so risk is sharply higher where the API is reachable from untrusted networks and lower where it is restricted to an isolated management VLAN. Impact is limited to disclosure of sensitive information (C:L), with no integrity or availability effect. |
| Impact | This is a moderate-severity information disclosure flaw (CVSS 5.3) in HPE Aruba ClearPass Policy Manager. The CVSS vector (AV:N/AC:L/PR:N/UI:N) is favorable to an attacker - network-reachable, low complexity, no privileges, no user interaction - which is why an authentication-bypass bug would normally draw attention. However, impact is bounded: only confidentiality is affected and only at Low (C:L/I:N/A:N), meaning limited sensitive information exposure rather than full compromise. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a credible, easy-to-reach bug worth prioritizing on exposed ClearPass management interfaces, but the low confidentiality-only impact makes it a mid-tier patch priority rather than an emergency, absent any exploitation signal. Note that CWE is N/A and no affected version data was supplied, so the precise nature of the leaked data and affected builds must be confirmed against the HPE advisory. |
| Exploit ScenarioDerived | A remote attacker with network access to the ClearPass Policy Manager API interface sends crafted requests that bypass the authentication controls guarding an API endpoint, returning sensitive data without valid credentials. Because no authentication, privileges, or user interaction are required (PR:N/UI:N) and complexity is low, the request can be issued directly against an exposed management interface. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated remote attackers who can reach the API interface of HPE Aruba ClearPass Policy Manager can circumvent existing authentication controls and read sensitive information from the appliance. The flaw is rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so no credentials or user interaction are required and the impact is confined to confidentiality disclosure with no integrity or availability effect. Exposure is the key risk driver: ClearPass management and API listeners are normally isolated on a management VLAN, and no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
No vendor-released patch version was identified in the provided intelligence, so the exact fixed release must be confirmed from HPE's advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US before any upgrade claim is made; use that bulletin as the authoritative source for the fixed build and apply it as soon as it is validated in the environment. Until a fixed build is confirmed, the highest-value control is reducing reachability of the API interface: enforce firewall rules so the ClearPass API/HTTPS management listener is reachable only from known automation hosts and administrator subnets, and move the API off any untrusted or guest-adjacent network onto a dedicated management VLAN. The trade-off is that over-tightening these rules will break third-party connectors (endpoint/MDM profiling, SIEM forwarding, ticketing and guest-portal integrations) that legitimately call the API, so allow-lists should be built from observed integration traffic rather than broad ranges. Where an integration does not require external reachability, disable or block its inbound path at the perimeter altogether; where a reverse proxy or WAF fronts the API, add rules that reject requests lacking a valid authenticated session so the anonymous bypass path cannot be exercised. Because exploitation is unauthenticated and only discloses data, also increase logging and alerting on anomalous or sessionless API requests to the ClearPass audit/event logs to catch attempted abuse, and rotate any credentials, tokens or secrets that were exposed through the interface, since disclosed configuration data can be reused for follow-on access even though this flaw itself does not grant code execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ClearPass Policy Manager is HPE Aruba Networking's network access control and policy engine, anchoring authentication, authorization and accounting for wired/wireless access (RADIUS, TACACS+), device profiling, guest workflows and BYOD onboarding. Its REST API and management interface are the integration surface used by endpoint-management, MDM, SIEM and ticketing connectors to push policy, pull session data and trigger automated actions. The reported defect sits in that API surface: an authentication control is applied incorrectly or not at all for at least one endpoint, so an unauthenticated caller can reach functionality or data that should require a valid session, resulting in disclosure of sensitive information. No CWE identifier was supplied in the source data; based on the described behavior the root-cause class is best characterized as an authentication-bypass weakness (improper authentication / missing authentication for a critical function, e.g. CWE-287 or CWE-306), but that mapping is our analytical characterization rather than a vendor-assigned identifier. The assessed vector (AV:N/AC:L/PR:N/UI:N) confirms the bypass is reachable over the network without credentials or user interaction and is not gated behind a non-default feature toggle; the sole limiting factor is whether the API interface is reachable from an untrusted network. No CPE strings were provided, so the affected build range cannot be pinned from the available data. Severity is held at 5.3 because only confidentiality is impacted (C:L) and scope remains unchanged.
Know when Aruba gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network API auth bypass yields AV:N/AC:L/PR:N/UI:N; impact is limited sensitive-info disclosure so C:L with I:N/A:N and unchanged scope.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A vulnerability in an API interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to obtain sensitive information from the affected system.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated r
There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code
A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products
Unauthenticated remote attackers can bypass authentication in the web management interface of HPE AOS-S (ArubaOS-Switch)
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access
Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not properly restrict access to unspecified administra
Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote at
Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via u
A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v
A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v
Unauthenticated remote attackers can trigger buffer overflows in an interface of HPE Aruba AOS-S (ArubaOS-Switch) that i
There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially
Exploit-DB