CVE-2026-76750 is an unauthenticated remote-code-execution flaw in HPE Networking ClearPass Policy Manager’s web interface. That matters because ClearPass is not an ordinary application server: it is the policy engine many organisations use to decide which people and devices may join wired, wireless and VPN networks.
ClearPass provides RADIUS and TACACS+ services, guest access, BYOD onboarding, endpoint profiling and posture checks across multivendor infrastructure. It is typically run by network and identity teams in centrally managed campus and enterprise environments, including businesses, schools and universities, hospitals, and municipal government. In short, the affected appliance often sits close to the controls that govern a large and varied device population.
Untrusted data reaches a code-execution path
The defect is deserialization of untrusted data. Deserialization is the process of turning received data back into an object or structure an application can use. It becomes dangerous when software accepts attacker-controlled serialized data and reconstructs it without safe constraints: crafted input can alter the application’s intended behavior and, in this case, lead to arbitrary code execution.
HPE says an attacker needs no account, privileges or user interaction: a remote attacker able to reach the vulnerable web interface can exploit the issue. The advisory does not disclose the affected endpoint, programming language, serialization mechanism, or the code path behind the flaw, so teams should not assume that blocking one guessed URL solves it. HPE assigns a 9.8 CVSS 3.1 score and identifies the issue as one of the fixes in its ClearPass advisory, alongside issues including CVE-2026-76752 and CVE-2026-76754.
Patch the appliance, then narrow its reach
Fixed releases are ClearPass Policy Manager 6.14.1 and later for the 6.14 branch, and 6.11.16 and later for the 6.11 branch. The human-readable advisory describes 6.14.0 and below, and 6.11.15 and below, as affected; its machine-readable entry is narrower for this CVE, listing 6.14.0 and 6.11.0 through 6.11.15. Either way, administrators should verify the installed release rather than infer safety from a branch name.
Unsupported versions deserve special attention. HPE did not assess their exposure individually and says end-of-maintenance releases should be presumed affected unless specifically excluded; end-of-support deployments should be treated as potentially impacted and upgraded to a supported release. If an upgrade cannot happen immediately, HPE’s interim guidance is to put CLI and web management on a dedicated Layer 2 segment or VLAN, or restrict them with Layer 3-or-higher firewall rules, while preserving accounting and activity logging.
That segmentation should be a containment measure, not a substitute for patching. Inventory internet-facing and internally reachable management interfaces, limit access to the administrators and jump hosts that genuinely need it, and review logs for anomalous access around the web interface.
No public exploitation evidence so far
As of October 10, 2026, no in-the-wild exploitation, attributed incident, public proof of concept, or working exploit code had been confirmed. HPE reported no known public exploit discussion or code when it published the advisory, and the CVE record’s CISA ADP assessment recorded exploitation as none. Absence of a public exploit is not evidence that private development has not happened.
The flaw is also not present in CISA’s Known Exploited Vulnerabilities catalogue as checked against the October 8 dataset. Still, an unauthenticated path to code execution on a network-policy appliance is enough to make remediation urgent. Track the actual ClearPass versions and interfaces your organisation runs; SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs.
