{"id":"CVE-2026-76752","published":"2026-10-06T20:17:30.623","lastModified":"2026-10-08T04:17:39.270","description":"Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authentication controls and gain administrative access to the affected system.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows unauthenticated remote attackers to bypass authentication and gain administrative access, compromising system security.","exploitability":"Exploitation is relatively easy given the lack of authentication requirements, and an attacker could exploit this by targeting the web-based management and API interfaces.","blast_radius":"If exploited, the attacker could gain full administrative control over the ClearPass Policy Manager, leading to potential data breaches and system compromise.","remediation":"Disable the web-based management and API interfaces until a patch is available, or apply the vendor's recommended update to the specific version: 'Upgrade to 2.590 or later'.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","api","admin-access"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:43:33.192Z"}}