Multiple Vulnerabilities in HPE Networking ClearPass Policy Manager

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

Critical

CVE-2026-79798

Other

October 6, 2026

Executive Summary

Twenty-eight vulnerabilities, led by CVE-2026-79798, a CVSS 9.9 SQL injection, plus unauthenticated RCE and authentication bypass flaws.

Key Details

Affected Platform

HPE Networking ClearPass Policy Manager

Attack Surface

Recommended Action

Apply vendor patch

Affected Environment

HPE Networking ClearPass Policy Manager 6.14.0 and below, and 6.11.15 and below, including OnGuard and client agents.

Operational Impact

Arbitrary code execution, administrative takeover, database manipulation, and service disruption on network access control infrastructure.

Technical Root Cause

SQL injection, deserialization of untrusted data, missing integrity verification, format string, command injection, and path traversal flaws.

Recommended Mitigation

Apply HPE updates and hot fixes to ClearPass and OnGuard clients; restrict management access to trusted networks.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

HPE Security Bulletin.