Unauthorized Access Risk in CPPM Guest Account Management by HPE
CVE-2026-73789

5.3MEDIUM

Key Information:

Vendor

HP (HP)

Status
Clearpass Policy Manager (cppm)
Vendor
CVE Published:
9 September 2026

What is CVE-2026-73789?

The CPPM Guest Account Management services feature a vulnerability in its web-based management interface that permits unauthenticated remote attackers to alter account settings. By exploiting this flaw, attackers can manipulate guest accounts to extend their network access beyond established policies, resulting in unauthorized and potentially prolonged usage of network resources. This situation poses serious security risks that necessitate immediate attention and remediation.

Affected Version(s)

ClearPass Policy Manager (CPPM) 6.12.0 <= 6.12.8

ClearPass Policy Manager (CPPM) 6.12.0 <= 6.12.8

ClearPass Policy Manager (CPPM) 6.11.0 <= 6.11.14

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0x50d
.