CVE-2024-26294

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)Aruba ClearPass Policy ManagerClearPass Policy Manager 6.12.x: 6.12.0; ClearPass Policy Manager 6.11.x: 6.11.6 and below; ClearPass Policy Manager 6.10.x: ClearPass 6.10.8 Hotfix Q4 2023 for Security issues and below; ClearPass Policy Manager 6.9.x: ClearPass 6.9.13 Hotfix Q4 2023 for Security issues and below
arubanetworksclearpass_policy_manager>= 6.11.0, <= 6.11.6
arubanetworksclearpass_policy_manager>= 6.10.0, <= 6.10.8_hotfix_q4_2023
arubanetworksclearpass_policy_manager>= 6.9.0, <= 6.9.13_hotfix_q4_2023
arubanetworksclearpass_policy_manager6.12.0

References

Timeline

Published
Feb 27, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-262958.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onCVE-2024-262968.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onCVE-2024-262978.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onCVE-2024-262988.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onCVE-2024-262994.8A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a CVE-2024-26306.5Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafteCVE-2024-263004.8A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-siCVE-2024-263016.5A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low priviCVE-2024-263024.8A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low priviCVE-2024-263034.9Authenticated Denial of Service Vulnerability in ArubaOS-Switch SSH DaemonCVE-2024-263049.8There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code executionCVE-2024-263059.8There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sendin
CVE-2024-26294: High severity, CVSS 8.8 | Vulnix