Description
A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an attacker to execute arbitrary code.
Published: 2026-10-06
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

This vulnerability is a format string flaw in a service interface of the ClearPass Policy Manager. The flaw can corrupt process memory, permitting an attacker to execute arbitrary code. The weakness is a classic extern‑controlled format string oversight (CWE‑134).

Affected Systems

The affected product is Hewlett Packard Enterprise – ClearPass Policy Manager. No specific version information is provided, but all installations that include the vulnerable service interface are impacted.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated remote attacker sending crafted data to the vulnerable service interface, resulting in memory corruption and code execution. Successful exploitation would grant the attacker full control over the affected system.

Generated by OpenCVE AI on October 6, 2026 at 22:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security patch released by HPE for ClearPass Policy Manager that addresses the format string flaw.
  • If a patch is not currently available, block or restrict unauthenticated access to the vulnerable service interface using firewall rules or access control lists.
  • Consider network segmentation to limit exposure of the ClearPass service to trusted networks only.
  • Monitor system logs for suspicious input patterns targeting the ClearPass service interface and investigate any anomalous activity promptly.

Generated by OpenCVE AI on October 6, 2026 at 22:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) clearpass Policy Manager (cppm)
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) clearpass Policy Manager (cppm)

Tue, 06 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-134

Tue, 06 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an attacker to execute arbitrary code.
Title Unauthenticated Format String Vulnerability in HPE Networking ClearPass Policy Manager
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Hewlett Packard Enterprise (hpe) Clearpass Policy Manager (cppm)
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-10-08T03:55:29.791Z

Reserved: 2026-08-19T16:14:02.299Z

Link: CVE-2026-76753

cve-icon Vulnrichment

Updated: 2026-10-07T19:00:19.791Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-06T20:17:30.740

Modified: 2026-10-08T04:17:39.570

Link: CVE-2026-76753

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T00:30:08Z

Weaknesses
  • CWE-134

    Use of Externally-Controlled Format String