HPE ClearPass Policy Manager: Missing integrity verification in client agent allows code execution
Summary
A missing integrity verification flaw in the client agent software of HPE Networking ClearPass Policy Manager (CPPM) allows an unauthenticated remote attacker to introduce untrusted code. Successful exploitation could allow arbitrary code execution on the affected client system. The CVSS score is 9.8 (critical). The specific component and the affected agent versions have not been publicly documented.
Affected
- HPE ClearPass Policy Manager 6.14.0 and earlier (6.14.0 affected per CNA record)
- HPE ClearPass Policy Manager 6.11.0 to 6.11.15
- Client agent builds: affected versions unknown
Fixed in
- ClearPass Policy Manager server: upgrade to 6.14.1 or 6.11.16
- Client agent: fixed version unknown; obtain the build list from the HPE Networking Support Portal and confirm with HPE
Workaround
- Restrict network reachability of client agent systems until the agent fix is applied
- No vendor-confirmed workaround available for the agent
Exploitation
- HPE is not aware of public exploit code or discussion as of the advisory release date
- No confirmed exploitation in the wild reported by Feedly at time of research
- CISA KEV status: not verified in a primary CISA source; check the CISA KEV catalog directly
- CISA SSVC: exploitation none, automatable yes, technical impact total
Our recommendation
- Check whether ClearPass Policy Manager is in use and which version is running
- Upgrade the CPPM server to 6.14.1 or 6.11.16 or later
- Inventory all client and OnGuard agents and obtain the fixed build from HPE; confirm with HPE if unsure
- Restrict which networks can reach the agents until patched
- Monitor for unexpected agent updates and for public exploit reports
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE advisory HPESBNW05158 rev.1 support.hpe.com
- Securityonline: ClearPass Policy Manager vulnerabilities securityonline.info
- Secure-iss advisory summary www.secure-iss.com
- CSA Singapore alert AL-2026-139 www.csa.gov.sg
- VulDB CVE-2026-79801 vuldb.com
- Feedly CVE-2026-79801 feedly.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:56.
Original description (NVD)
A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code. Successful exploitation could allow an attacker to execute arbitrary code on the affected client system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.