Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Critical Vulnerabilities in HPE Networking ClearPass Policy Manager

12 October 2026

Attackers can exploit critical vulnerabilities in HPE Networking ClearPass Policy Manager to bypass authentication, execute arbitrary code, or gain full administrative access to the affected system. Patch immediately.

Background

HPE has released security updates to address multiple critical vulnerabilities (CVE-2026-79798, CVE-2026-76750, CVE-2026-76751, CVE-2026-76752, CVE-2026-76753, CVE-2026-76754, CVE-2026-79796, CVE-2026-79801, CVE-2026-79805, and CVE-2026-79794) affecting HPE Networking ClearPass Policy Manager (CPPM). 

These vulnerabilities have a Common Vulnerability Scoring System (CVSS v3.1) score of:

  • CVE-2026-79798 at 9.9,

  • CVE-2026-76750, CVE-2026-76751, CVE-2026-76752, CVE-2026-76753, CVE-2026-76754, CVE-2026-79796, CVE-2026-79801, and CVE-2026-79805 at 9.8, and

  • CVE-2026-79794 at 9.1, out of 10.

Impact

Successful exploitation of these vulnerabilities could result in the following impacts:

  • CVE-2026-79798: Due to a SQL injection vulnerability in the web-based management interface, an authenticated remote attacker with low privileges could execute arbitrary database commands to compromise the affected system, with potential impact on additional connected systems.

  • CVE-2026-76750: Due to a deserialization of untrusted data vulnerability in the web interface, an unauthenticated remote attacker could execute arbitrary code on the affected system.

  • CVE-2026-76751: Due to a missing integrity verification vulnerability in the OnGuard agent, an unauthenticated remote attacker could execute arbitrary code on the affected endpoint with the elevated privileges of the agent.

  • CVE-2026-76752: Due to authentication bypass vulnerabilities in the web-based management and API interfaces, an unauthenticated remote attacker could circumvent existing authentication controls to gain administrative access to the affected system.

  • CVE-2026-76753: Due to a format string vulnerability in an affected service interface, an unauthenticated remote attacker could corrupt process memory to execute arbitrary code on the affected system.

  • CVE-2026-76754: Due to a SQL injection vulnerability in an affected interface, an unauthenticated remote attacker could execute arbitrary database commands on the affected system.

  • CVE-2026-79796: Due to authentication bypass vulnerabilities in an affected interface, an unauthenticated remote attacker could circumvent existing authentication controls to gain unauthorised access to the affected system.

  • CVE-2026-79801: Due to a missing integrity verification vulnerability in the client agent, an unauthenticated remote attacker could execute arbitrary code on the affected system.

  • CVE-2026-79805: Due to a path traversal vulnerability in ClearPass Policy Manager, an authenticated attacker could read and modify certain files on the underlying operating system.

  • CVE-2026-79794: Due to a SQL injection vulnerability in the web-based management interface, an authenticated remote attacker could execute arbitrary database commands.

Affected Products

These vulnerabilities affect the following HPE Networking ClearPass Policy Manager versions:

  • CPPM 6.14.0 and below

  • CPPM 6.11.15 and below

Recommendations

Users and administrators of affected products are advised to update to the latest versions immediately.

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-79798 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-76750 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-76751 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-76752 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-76753 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-76754 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-79796 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-79801 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-79805 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-79794 (opens in new tab)