CVE-2024-26297

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Feb 27, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-262988.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onCVE-2024-262994.8A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a CVE-2024-26306.5Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafteCVE-2024-263004.8A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-siCVE-2024-263016.5A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low priviCVE-2024-263024.8A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low priviCVE-2024-263034.9Authenticated Denial of Service Vulnerability in ArubaOS-Switch SSH DaemonCVE-2024-263049.8There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code executionCVE-2024-263059.8There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sendinCVE-2024-263065.9iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption CVE-2024-263075.3Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run the risk of someone renaming theCVE-2024-263085.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: fr