ClearPass Policy Manager: Authentication bypass
Summary
A flaw in an unnamed interface of HPE ClearPass Policy Manager (CPPM) allows an unauthenticated remote attacker to bypass existing authentication controls and gain unauthorized access to the system. CPPM is the network access control platform that answers authentication and authorization requests from switches and wireless controllers, so a compromise affects access policy across the network. HPE does not state which interface is affected, so exposure depends on whether the server is reachable from untrusted networks.
Affected
- CPPM 6.14.0 (per the CVE record: 6.14.0 to <= 6.14.0)
- CPPM 6.11.0 to 6.11.15
- End-of-maintenance releases: HPE presumes they are affected but does not cover them, so treat them as vulnerable.
Fixed in
- Upgrade to CPPM 6.14.1 or 6.11.16 (or later), per HPE advisory HPESBNW05158.
- No separate patch or hotfix exists for this CVE; the version upgrade is the fix.
Workaround
Unknown. No CVE-specific workaround is published. HPE's general guidance is to upgrade, restrict management interfaces and keep activity logs.
Exploitation
- No known exploits according to Tenable; HPE is not aware of public discussion or exploit code as of the advisory date.
- CISA SSVC: exploitation none, automatable yes, total technical impact.
- Not listed in CISA KEV. EPSS is about 0.5% (third-party aggregator).
- No public proof of concept found.
Our recommendation
- Inventory all CPPM instances and versions, including end-of-maintenance systems and cluster members.
- Upgrade to 6.14.1 or 6.11.16 (or later) as soon as possible.
- Until patched, restrict access to management and web/API interfaces to dedicated admin networks and block internet exposure.
- Check logs for unexpected administrative logins.
- Track HPE's separate PHP2Shell fix (advisory HPESBNW05171), as 6.14.1 and 6.11.16 only partly mitigate that issue.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE advisory HPESBNW05158 support.hpe.com
- Tenable plugin 364195 www.tenable.com
- secure-iss.com summary www.secure-iss.com
- OpenCVE CVE-2026-79796 app.opencve.io
- SecurityOnline ClearPass vulnerabilities securityonline.info
- CSA Singapore alert AL-2026-139 www.csa.gov.sg
- CCB Belgium warning on ClearPass vulnerabilities ccb.belgium.be
- HPE advisory HPESBNW05171 (PHP2Shell) support.hpe.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:55.
Original description (NVD)
Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.