CVE-2026-76753
validatedZero produced an exploit or a check.GHSA-62qp-w4gp-5m8w ↗EUVD-2026-93880 ↗
description
Affected ClearPass Policy Manager deployments contain a format string flaw in a service interface. A remote attacker who can reach that interface without authentication may corrupt process memory and potentially execute code.
mitigation
Limit network access to the affected service interface to trusted hosts and networks until vendor remediation can be applied. Monitor the vendor's advisory channel for an update or supported remediation guidance.
outcome
Contextual check: a technique exists and was validated, but no deterministic check could cover this one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-06 19:16Zghsa: trigger signal, started the run
- 2026-10-06 19:16Zcve.org record for CVE-2026-76753
this entry in the feed
GET /api/v1/feed/CVE-2026-76753
{ "etk_id": "ETK-2026-820", "cve_id": "CVE-2026-76753", "display_id": "CVE-2026-76753", "ghsa_id": "GHSA-62qp-w4gp-5m8w", "euvd_id": "EUVD-2026-93880", "status": "published", "anchor_state": "anchored", "title": "Format string flaw in ClearPass Policy Manager service interface", "summary": "Affected ClearPass Policy Manager deployments contain a format string flaw in a service interface. A remote attacker who can reach that interface without authentication may corrupt process memory and potentially execute code.", "mitigation": "Limit network access to the affected service interface to trusted hosts and networks until vendor remediation can be applied. Monitor the vendor's advisory channel for an update or supported remediation guidance.", "vendor": "hewlett packard enterprise (hpe)", "product": "ClearPass Policy Manager (CPPM)", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 6.14.0, <= 6.14.0", ">= 6.11.0, <= 6.11.15" ], "ecosystem": null, "fixed_versions": [], "package_name": "ClearPass Policy Manager (CPPM)", "purl": null } ], "cwes": null, "cvss_score": 9.8, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "epss_score": 0.0053, "epss_percentile": 0.4365, "epss_asof": "2026-10-21", "automation": "contextual", "check": true, "check_confidence_basis": "assessed", "exploit": false, "pipeline_minutes": 17.951862683333335, "t0_at": "2026-10-06T19:16:57.720000+00:00", "signals": { "check": { "at": "2026-10-07T23:57:21.904109+00:00", "days": 1.194724353113426, "is_lower_bound": false, "measured_at": "2026-10-06T19:16:57.720000+00:00", "url": null }, "trigger_signal": { "at": "2026-10-06T19:16:57.720000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-06T19:16:57.720000+00:00", "url": "https://github.com/advisories/GHSA-62qp-w4gp-5m8w" } } }
published 2026-10-06 23:06Z
last change 2026-10-21 20:26Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.