Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-73789

Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web Interface

CVSS 3.1 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-73789

Published

A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attacker to manipulate account settings. Successful exploitation could allow an attacker to extend network access beyond policy limits, leading to unauthorized prolonged use of network resources.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-73789

Published

ClearPass Policy Manager (CPPM)

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Hewlett Packard Enterprise (HPE)",
                    "product": "ClearPass Policy Manager (CPPM)",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "6.12.0",
                            "lessThanOrEqual": "6.12.8",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "6.11.0",
                            "lessThanOrEqual": "6.11.14",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "affected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON