CVE-2026-76754 – HPE ClearPass Policy Manager (CPPM)
“When the system that decides who gets on your network can be taken over without a password, every connected device is at risk.”
This HPE update fixes ten Critical vulnerabilities in ClearPass Policy Manager (CPPM), the platform that controls network access across the enterprise. The flaws include deserialization of untrusted data, authentication bypass, format string memory corruption, SQL injection, missing integrity checks in the OnGuard and client agents, and path traversal. Most can be exploited remotely without authentication. A successful attacker could run arbitrary code, gain administrative access, issue arbitrary database commands, or read and modify files on the underlying operating system. The agent flaws also allow code execution on managed endpoints with elevated privileges.
CVE-2026-76750, CVE-2026-76751, CVE-2026-76752, CVE-2026-76753 and CVE-2026-76754 each have a CVSS score of 9.8, Critical severity. CVE-2026-79794 has a CVSS score of 9.1, Critical severity. CVE-2026-79796 has a CVSS score of 9.8, Critical severity. CVE-2026-79798 has a CVSS score of 9.9, Critical severity. CVE-2026-79801 and CVE-2026-79805 each have a CVSS score of 9.8, Critical severity.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-77