HPE ClearPass Policy Manager: Unauthenticated remote code execution via deserialization
Summary
Deserialization of untrusted data in the web interface of HPE ClearPass Policy Manager allows an unauthenticated remote attacker to execute arbitrary code on the affected system. No user interaction or login is required if the web interface is reachable over the network. ClearPass is a network access control platform, so a compromise could expose credentials, device data and network access policies.
Affected
- HPE ClearPass Policy Manager (CPPM) 6.14.0
- HPE ClearPass Policy Manager (CPPM) 6.11.0 to 6.11.15
- Other branches: unknown, check the vendor advisory
Fixed in
- CPPM 6.11.16
- CPPM 6.14.1
Workaround
- No workaround removes the flaw; applying the patch is the fix.
- HPE recommends placing the CLI and web interfaces on a dedicated layer 2 segment or VLAN, or behind firewall policies, and logging user activity.
- Restricting web access to trusted IP ranges or VPN is a commonly suggested third-party measure.
Exploitation
- Not listed in the CISA KEV catalog at the time of research.
- HPE and Tenable report no known exploitation or public exploit code as of the advisory date.
- Exploitation is considered automatable (CISA SSVC).
- Public proof-of-concept: none found; this does not prove that none exists.
Our recommendation
- Check the HPE advisory HPESBNW05158 for your exact CPPM version and upgrade to 6.11.16 or 6.14.1 (or later).
- Until patched, limit web and API access to administrative networks or VPN and review logs for unexpected web requests.
- Check whether the ClearPass admin interface is reachable from the internet and treat any exposed instance as high priority.
- Patch the other CVEs in the same HPE bundle in the same maintenance window, including CVE-2026-76752.
- Monitor for public exploit code.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05158 support.hpe.com
- CCB Belgium advisory ccb.belgium.be
- Tenable plugin 364195 www.tenable.com
- VulDB CVE-2026-76750 vuldb.com
- CSA Singapore alert AL-2026-139 www.csa.gov.sg
- SecurityOnline ClearPass vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:56.
Original description (NVD)
Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.