HPE has patched a critical, unauthenticated vulnerability in ClearPass Policy Manager, the network access control platform enterprises use to decide which devices and users get onto their network. The flaw, tracked as CVE-2026-76753, is a format string bug that lets a remote attacker corrupt process memory and potentially run arbitrary code, with no login required. It carries a CVSS score of 9.8, the top end of the critical range. HPE published the fix on October 6, 2026, and versions through CPPM 6.14.0 and 6.11.15 are affected.
What the Vulnerability Actually Does
According to the official CVE record published by HPE’s own CNA, the bug sits in “an affected service interface” of ClearPass Policy Manager. Format string vulnerabilities happen when user-supplied input gets passed directly into a function that expects a formatting template, which an attacker can abuse to read or write memory they shouldn’t be able to touch. In this case, that opens the door to remote code execution on the box, without any credentials and without the attacker needing to trick a user into clicking anything.
CISA’s vulnerability enrichment data, attached to the same CVE record, rates the flaw as automatable and notes the technical impact as total. There’s no sign of active exploitation yet and no public proof-of-concept circulating, which is the one piece of good news here. That tends to change quickly once a patch is out and researchers start reverse engineering the diff.
Why ClearPass Is a Bigger Target Than It Looks
ClearPass isn’t a typical app server. It’s the thing deciding whether a laptop, phone, or IoT device gets network access in the first place, which means it usually sits with elevated trust and visibility across the network it protects. A critical, unauthenticated flaw in a product whose entire job is enforcing access control is a worse outcome than the same bug in an ordinary web app, because a compromised ClearPass instance can become a foothold for moving deeper into everything it was supposed to be guarding.
What to Do About It
HPE’s fix is already out. Admins running CPPM 6.14.0 or earlier, or 6.11.15 or earlier, should move to a patched build without waiting for a maintenance window if the appliance is reachable from anywhere other than a tightly locked-down management network. Until the upgrade happens, restricting network access to the ClearPass management interfaces to trusted IP ranges only cuts down the exposure meaningfully, since the attack requires network reachability to the affected service.
This is the same pattern seen in other recent critical infrastructure disclosures, including the Citrix NetScaler zero-day and the Atlassian file access flaw patched earlier this month: unauthenticated, network-reachable, and critical the moment it’s public. Teams running any enterprise access or identity infrastructure are worth checking against vendor advisories on a regular cadence, not just when something makes headlines. More of this kind of coverage lives in our News & Updates section.
