HPE ClearPass Policy Manager: 20 Vulnerabilities Disclosed, Including Critical SQLi and Auth Bypass Flaws
HPE ClearPass Policy Manager faces a critical security event with the simultaneous disclosure of 20 vulnerabilities, including multiple critical flaws in API, agent, and client components.
Key findings
- 20 vulnerabilities disclosed simultaneously for HPE ClearPass Policy Manager on October 6, 2026.
- Critical vulnerabilities include SQL injection (up to CVSS 9.9) and command injection allowing code execution and privilege escalation.
- Multiple flaws affect API interfaces, OnGuard agent, and client software, enabling authentication bypass and information disclosure.
- Path traversal and buffer overflow vulnerabilities increase the risk of unauthorized access and system compromise.
- Immediate patching and security review are critical for all ClearPass Policy Manager deployments.
On October 6, 2026, a significant batch of 20 vulnerabilities was disclosed for HPE's ClearPass Policy Manager. These vulnerabilities, all disclosed on the same day, span a range of severity levels from Medium to Critical, with several critical flaws carrying CVSSv3 scores of 9.8 and 9.9. The disclosures highlight a broad range of security weaknesses affecting various components of ClearPass Policy Manager, including its API interfaces, OnGuard agent, and web-based management interface. The sheer volume and severity of these vulnerabilities underscore the critical need for immediate attention and patching by organizations utilizing this network access control solution.
Several vulnerabilities center around command injection and SQL injection, posing serious threats to data integrity and system control. CVE-2026-79815, CVE-2026-79803, and CVE-2026-79802 detail command injection flaws in the OnGuard agent and API, with the latter two allowing for privilege escalation and administrative control. The SQL injection vulnerabilities, including the critical CVE-2026-79798 (CVSSv3 9.9), CVE-2026-79794, CVE-2026-76754, and CVE-2026-79811, could permit attackers to execute arbitrary database commands, potentially leading to data breaches or system compromise.
Another critical theme among the disclosures is the bypass of authentication and authorization controls. CVE-2026-79817 and CVE-2026-79796 point to sensitive information disclosure and improper access control respectively, while CVE-2026-79816 describes a DOM-based cross-site scripting (XSS) vulnerability. More alarmingly, CVE-2026-79809 (path traversal) and CVE-2026-79796 (improper access control) allow unauthenticated remote attackers to influence authorization decisions and gain unintended roles or sensitive information.
The OnGuard agent and client software are particularly affected by several high and critical severity vulnerabilities. CVE-2026-79808, a buffer overflow in the OnGuard agent, could allow local authenticated users to execute arbitrary code with elevated privileges. Similarly, CVE-2026-79807 highlights a missing integrity verification vulnerability in the Windows client, enabling privilege escalation. Critical vulnerabilities CVE-2026-79801 and CVE-2026-76751, also affecting client agent software, allow for the introduction of untrusted code and arbitrary code execution with elevated privileges. CVE-2026-79797, an improper access control vulnerability in the Android client, could allow unauthenticated remote attackers to obtain sensitive information.
The batch also includes vulnerabilities that could lead to denial of service. CVE-2026-79812, a denial of service vulnerability in the OnGuard agent, could allow authenticated local attackers to interrupt the agent's operation.
The critical CVE-2026-79805 stands out with its ability to allow an authenticated attacker to read and modify certain files on the underlying operating system, posing a significant risk to system integrity. Furthermore, CVE-2026-79796, an improper access control vulnerability in the Android client, could allow unauthenticated remote attackers to obtain sensitive information.
The disclosures indicate that multiple components of ClearPass Policy Manager are affected, including its API interfaces, OnGuard agent, client software (Windows, Android), and web-based management interface. The vulnerabilities range from unauthenticated remote attacks to authenticated local and remote attacks, emphasizing the need for a comprehensive security review and patching strategy for all ClearPass Policy Manager deployments.
Given the severity and breadth of these vulnerabilities, immediate patching is strongly recommended. Organizations should consult HPE's official advisories for specific version information and remediation steps. The simultaneous disclosure of such a large number of critical flaws suggests a coordinated discovery and reporting effort, highlighting a significant security posture concern for users of HPE ClearPass Policy Manager.
The affected versions and specific patch details are not provided in the initial disclosure information. Users are advised to consult HPE's security advisories for the most up-to-date information on affected versions and available patches.
This extensive set of vulnerabilities demands immediate attention from all users of HPE ClearPass Policy Manager. The potential for attackers to gain unauthorized access, execute arbitrary code, and compromise sensitive data necessitates a swift and thorough response.
The vulnerabilities disclosed include: CVE-2026-79818, CVE-2026-79817, CVE-2026-79816, CVE-2026-79815, CVE-2026-79812, CVE-2026-79811, CVE-2026-79809, CVE-2026-79808, CVE-2026-79807, CVE-2026-79805, CVE-2026-79803, CVE-2026-79802, CVE-2026-79801, CVE-2026-79799, CVE-2026-79798, CVE-2026-79797, CVE-2026-79796, CVE-2026-79794, CVE-2026-76754, CVE-2026-76751.