Description
Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.
Published: 2026-10-06
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution
Action: Immediate patch
AI Analysis

Impact

Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.

Affected Systems

Hewlett Packard Enterprise’s ClearPass Policy Manager (CPPM) web interface is vulnerable. No specific versions are listed, so all installations of CPPM should be considered potentially affected until confirmed otherwise.

Risk and Exploitability

The CVSS score of 9.8 classifies this flaw as critical, indicating a high likelihood of severe impact if exploited. The EPSS score is not available, but the absence of a KEV listing does not reduce the urgency. An unauthenticated attacker can reach the web interface over the network, deserialize arbitrary data, and trigger arbitrary code execution without requiring credentials.

Generated by OpenCVE AI on October 6, 2026 at 22:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch or upgrade to a version where the deserialization issue is fixed.
  • Restrict external access to the ClearPass web interface, allowing only trusted IP ranges or VPN connections.
  • Implement network segmentation and firewall rules to isolate the ClearPass server from untrusted network segments.

Generated by OpenCVE AI on October 6, 2026 at 22:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) clearpass Policy Manager (cppm)
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) clearpass Policy Manager (cppm)

Tue, 06 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-502

Tue, 06 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.
Title Unauthenticated Deserialization of Untrusted Data allows Remote Code Execution in the Web Interface of HPE Networking ClearPass Policy Manager
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Hewlett Packard Enterprise (hpe) Clearpass Policy Manager (cppm)
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-10-08T03:55:27.691Z

Reserved: 2026-08-19T16:14:02.299Z

Link: CVE-2026-76750

cve-icon Vulnrichment

Updated: 2026-10-07T19:18:09.491Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-06T20:17:30.397

Modified: 2026-10-08T04:17:38.110

Link: CVE-2026-76750

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T00:30:08Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data