CVE-2024-26295

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-262968.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2024-262978.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2024-262988.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2024-262994.8A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a CVE-2024-26306.5Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafte CVE-2024-263004.8A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-si CVE-2024-263016.5A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privi CVE-2024-263024.8A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privi CVE-2024-263034.9Authenticated Denial of Service Vulnerability in ArubaOS-Switch SSH Daemon CVE-2024-263049.8There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execution CVE-2024-263059.8There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sendin CVE-2024-263065.9iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption