HPE Aruba Networking ClearPass (NAC) Vulnerabilities & Security Advisories
48 advisories tracked · HPE Aruba Networking Security Advisories (PSIRT) via NVD · 0 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published HPE Aruba Networking advisory that VulniPulse classified as ClearPass (NAC), with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 10 critical, 19 high, 19 medium.
Android app · Google Play
Monitor Aruba CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Source
HPE Aruba Networking Security Advisories (PSIRT) via NVD
Aruba's PSIRT bulletin portal (arubanetworks.com) is a JavaScript app with no stable public feed, so VulniPulse ingests Aruba's CVEs from NVD. Aruba publishes under the shared HPE CNA (security-alert@hpe.com), which also covers non-networking HPE products — so this feed is filtered to the full HPE Aruba Networking portfolio: ClearPass, AOS-8 mobility controllers, AOS-10 gateways and APs, Instant APs, AOS-CX and legacy AOS-Switch, Aruba Central, Fabric Composer and EdgeConnect/Silver Peak SD-WAN. Each entry links back to the official Aruba/HPE advisory when NVD carries the reference.
Latest Aruba ClearPass (NAC) advisories
Critical [CVE-2026-79805] ClearPass Policy Manager: authenticated path traversal vulnerability exists in ClearPass Policy Manager
An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the underlying operating system. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-79801] ClearPass Policy Manager: missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code
A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code. Successful exploitation could allow an attacker to execute arbitrary code on the affected client system. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-79798] ClearPass Policy Manager: SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance
SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-79796] ClearPass Policy Manager: Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls
Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain unauthorized access to the affected system. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-79794] ClearPass Policy Manager: SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance
A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-76754] ClearPass Policy Manager: vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance
A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-76753] ClearPass Policy Manager: format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory
A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an attacker to execute arbitrary code. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-76752] ClearPass Policy Manager: Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager
Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authentication controls and gain administrative access to the affected system. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-76751] ClearPass Policy Manager: missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager
A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an unauthenticated, remote attacker to execute arbitrary code on the affected endpoint with the elevated privileges of the agent. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-76750] ClearPass Policy Manager: Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager
Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system. Affected product named by the advisory: ClearPass Policy Manager (CPPM).