External risk intelligence

HPE ClearPass Policy Manager Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-76752

The vulnerability affects web-based management and API interfaces of a network policy manager, which are typically deployed as internet-facing or edge services for centralized authentication and policy control, often requiring accessibility for remote endpoints or distributed network infrastructure.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Authentication bypass vulnerabilities in HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to gain administrative access, potentially impacting the security and control of network access. The main concern is confirming relevance and exposure to this critical issue.

Bypasses authentication for administrative access.
Critical for network access control systems.
Assess exposure and validate system relevance.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could reach the vulnerable interfaces of HPE Networking ClearPass Policy Manager over the network, bypassing security measures. This could allow them to gain full administrative control of the system.

No authentication required.
Attacker accesses web or API interfaces.
Grants administrative access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to bypass authentication and gain administrative access to HPE Networking ClearPass Policy Manager. This could affect sensitive system configurations and data managed by ClearPass when the web-based management or API interfaces are exposed externally.

Administrative access to ClearPass.
Bypassing authentication controls.
Unauthorized system configuration changes.

Operational Fix

Recommended remediation, mitigation, and detection steps

Authentication bypass vulnerabilities in HPE Networking ClearPass Policy Manager's web and API interfaces require immediate attention. Initial steps involve identifying all ClearPass instances, determining their exposure and criticality, and locating the accountable system owner for coordinated remediation. Teams likely responsible include infrastructure, network security, and potentially vendor management if supported through a managed service.

Ownership: Infrastructure and Network Security teams.
Verify first: External accessibility and business criticality.
Action: Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is HPE Networking ClearPass Policy Manager?

ClearPass Policy Manager is a centralized network security platform that manages authentication, authorization, and policy enforcement for devices connecting to enterprise networks. It acts as a policy engine to determine which users and devices are granted access to specific network resources based on defined security rules.

How does this authentication bypass work?

This vulnerability allows an attacker to gain administrative access without providing valid credentials. By targeting the system's web-based management or API interfaces, an attacker can circumvent the authentication mechanism intended to protect the administrative console, effectively bypassing the security gates that keep unauthorized users out.

Do I need to be logged in to trigger CVE-2026-76752?

No, this vulnerability does not require any prior authentication or existing user session to trigger. The flaw exists in the interface itself, meaning an attacker can attempt to reach these systems remotely and initiate the bypass attempt directly, without any legitimate access privileges to the software.

Is my ClearPass instance at risk?

According to Halo Surface Signal, this vulnerability is particularly significant for instances with exposed web or API interfaces. Systems deployed as internet-facing or edge services, which are commonly configured to allow remote endpoint connectivity, carry a higher risk compared to those strictly restricted to internal management segments.

How should I respond to this vulnerability?

Start by identifying all ClearPass Policy Manager deployments within your environment. Work with infrastructure and network security teams to determine if these interfaces are accessible from outside your secure perimeter. Once mapped, prioritize those instances for remediation and coordinate with your vendor for official updates.

References

support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.