CVE-2026-73786

Unauthenticated Network-Based Denial of Service in CPPM systems

View on CVE.org
Published Sep 9, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack. Successful exploitation could allow an attacker to cause instability and degrade performance of the vulnerable CPPM server.

Analysis

AI-generated

Technical impact

A flaw in the web‑based management interface of HPE ClearPass Policy Manager permits an unauthenticated remote attacker to trigger a denial‑of‑service condition, causing the server to become unstable and its performance to degrade.

Affected Systems

HPE ClearPass Policy Manager. No specific version information is supplied, so all installations should verify whether they are affected and apply any available fixes.

Risk and Exploitability

The vulnerability scores a CVSS of 7.5, indicating high severity. An attacker can exploit it over the network without authentication, targeting the management interface. Because the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, the current probability of exploitation is unknown, but the potential impact on availability makes it a concern for environments that rely on uninterrupted policy management services.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch that addresses the DoS issue in ClearPass Policy Manager.
  • Limit access to the web‑based management interface with firewall rules or network segmentation, allowing only trusted administrative networks.
  • Enable monitoring of CPU, memory, or service availability, and set alerts for abnormal traffic patterns that may indicate an ongoing DoS attempt.

Generated by OpenCVE AI on September 9, 2026 at 20:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) clearpass Policy Manager (cppm)
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) clearpass Policy Manager (cppm)
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-400
Type Values Removed Values Added
Description A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack. Successful exploitation could allow an attacker to cause instability and degrade performance of the vulnerable CPPM server.
Title Unauthenticated Network-Based Denial of Service in CPPM systems
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

Sources

Status
PUBLISHED
Assigner
hpe
Published
Updated
Sep 10, 2026, 2:52 PM
Reserved
Aug 13, 2026, 4:39 PM

View source JSON

Updated
Sep 10, 2026, 2:52 PM

JSON

Status
Awaiting Analysis
Published
Sep 9, 2026, 8:20 PM
Modified
Sep 10, 2026, 3:47 PM

View source JSON

No data.

Updated
Sep 10, 2026, 8:09 PM

JSON