The OnGuard agent component of Hewlett Packard Enterprise’s ClearPass Policy Manager contains a command injection vulnerability that permits an authenticated remote attacker to supply arbitrary operating‑system commands. When exploited, the agent executes these commands with elevated privileges on the Windows endpoint, effectively providing the attacker with full remote code execution capabilities and compromising confidentiality, integrity, and availability.

The affected system is the ClearPass Policy Manager OnGuard Agent deployed on Windows endpoints. Hewlett Packard Enterprise is the vendor; the product is ClearPass Policy Manager with the OnGuard Agent component. No specific product or version information is disclosed in the advisory.

The vulnerability carries a CVSS score of 6.5, reflecting moderate to high severity. Its EPSS score of 0.00612 indicates a very low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires vendor‑authenticated access; once authenticated, an attacker can remotely inject and run arbitrary commands. While no public exploits are available, the low EPSS score suggests that active adversaries with the necessary credentials could potentially target this weakness.