HPE ClearPass Policy Manager: Unauthenticated format string vulnerability
Summary
A format string vulnerability in an unnamed service interface of HPE ClearPass Policy Manager (CPPM) allows an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow arbitrary code execution. CPPM is a central access-control system, so a compromise could expose network access policies and authentication configuration. CVSS 9.8 (critical).
Affected
- HPE Networking ClearPass Policy Manager 6.14.0 and earlier within the 6.14 branch (6.14.0)
- HPE Networking ClearPass Policy Manager 6.11.0 to 6.11.15
- Whether older branches are affected is unknown; one source lists the 6.11 range from 6.11.0.
Fixed in
- Upgrade to CPPM 6.14.1 or later
- Upgrade to CPPM 6.11.16 or later
- Fixed builds are available from the HPE Networking Support Portal.
Workaround
Unknown. No vendor workaround was found in the available sources.
Exploitation
- HPE is not aware of public discussion or exploit code targeting the listed vulnerabilities at the time of the advisory.
- The CVE is not listed in the CISA KEV catalog.
- CISA SSVC rates it as automatable with total technical impact.
- No public proof of concept or in-the-wild exploitation was found; EPSS is 0.00525.
Our recommendation
- Patch CPPM to 6.14.1 or 6.11.16 or later as soon as possible.
- Restrict access to the CPPM web and service interfaces to management networks and remove any internet exposure until patched.
- Check whether any CPPM management or service port is reachable from the internet.
- Apply the other fixes in the same HPE bulletin, since patching this CVE alone does not close it.
- Monitor CPPM logs for unusual requests or configuration changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE advisory HPESBNW05158 rev.1 support.hpe.com
- CSA Singapore alert AL-2026-139 www.csa.gov.sg
- CCB Belgium warning on HPE ClearPass Policy Manager ccb.belgium.be
- SecurityOnline summary of ClearPass Policy Manager vulnerabilities securityonline.info
- OpenCVE CVE-2026-76753 app.opencve.io
- Vulners/Tenable vulnrichment CVE-2026-76753 vulners.com
- Strix CVE-2026-76753 www.strix.ai
- HPE community forum on related PHP CVEs community.networking.hpe.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:58.
Original description (NVD)
A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an attacker to execute arbitrary code.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.