Threat level Severe
Contact
Critical 9.8
CVE-2026-76753

HPE ClearPass Policy Manager (CPPM) — remote code execution.

A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory.

WeaknessCWE-134
Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
0.5%
Higher than 44% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an attacker to execute arbitrary code.

What to do

  1. 01Check whether you run HPE ClearPass Policy Manager (CPPM), and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCVE-2026-1146259.9Arista VeloCloud OrchestratorCVE-2026-1114979.8Google Brotli
Vendor
HPE50 CVEs in 30 days
All HPE CVEs

Other CVEs in HPE ClearPass Policy Manager (CPPM)

9 more CVEs

All HPE ClearPass Policy Manager (CPPM) CVEs
9.8HPE ClearPass Policy Manager (CPPM) — path traversal.EPSS 0.4%9.8HPE ClearPass Policy Manager (CPPM) — authentication bypass.EPSS 0.5%9.9HPE ClearPass Policy Manager (CPPM) — SQL injection.EPSS 0.3%9.8HPE ClearPass Policy Manager (CPPM) — remote code execution.EPSS 0.3%9.8HPE ClearPass Policy Manager (CPPM) — remote code execution.EPSS 0.5%9.8HPE ClearPass Policy Manager (CPPM) — remote code execution.EPSS 0.3%