CVE-2026-73786

CVE-2026-73786 is a denial-of-service flaw in the web-based management interface of HPE Aruba ClearPass Policy Manager (CPPM), HPE's network access control (NAC) platform. An unauthenticated remote attacker can trigger it by sending malicious requests to the vulnerable management interface, with no credentials or user interaction required. Successful exploitation degrades performance and causes instability of the CPPM server, impacting availability only — there is no confidentiality or integrity impact per the CVSS vector. Organizations running affected CPPM deployments are in scope, though the affected version ranges are not specified in the available advisory data. Exploitation has not been observed: the flaw is not in CISA's KEV and no public proof-of-concept is known.

What to do: Review whether your CPPM web management interface is reachable from untrusted networks and restrict access to trusted management networks or via VPN/firewall rules as an interim mitigation. Monitor the HPE-Aruba security advisory for the affected version ranges and patched releases (not included in this data) and apply the vendor update promptly once published, since no public PoC or in-the-wild exploitation is currently known.