CVE-2026-73788

Executive Summary

CVE-2026-73788 is a privilege escalation vulnerability in the ClearPass OnGuard endpoint agent. An authenticated remote attacker can exploit the flaw to elevate their own privileges, potentially obtaining root on a vulnerable ClearPass OnGuard deployment and enabling unauthorized operation of the affected system. No public proof-of-concept, exploit code, Nuclei template, or vendor patch is currently available, and EPSS has not yet scored the issue.

Technical Analysis

The NVD description states that a vulnerability in the ClearPass OnGuard agent allows an authenticated remote attacker to elevate their own privileges on a vulnerable deployment. Successful exploitation could allow an attacker to obtain root privileges, leading to potentially unauthorized operation of the vulnerable system.

The vulnerability class is privilege escalation via improper privilege management (CWE-269). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N indicates:

• Attack Vector: Network (AV:N) — the attacker reaches the vulnerable component over the network rather than requiring local console access.
• Attack Complexity: Low (AC:L) — no specialized conditions or race windows are indicated.
• Privileges Required: Low (PR:L) — the attacker must already hold an authenticated, low-privileged account or session on the affected system.
• User Interaction: None (UI:N) — no victim action is required.
• Scope: Unchanged (S:U) — the exploited component's security authority is not expected to cross into another security scope.
• Confidentiality: None (C:N) — the vector does not claim a confidentiality impact.
• Integrity: High (I:H) — the attack produces a serious loss of integrity, consistent with an attacker modifying system state through elevated privileges.
• Availability: None (A:N) — no availability impact is claimed.

The affected product is the ClearPass OnGuard agent, the endpoint component of the ClearPass network access control (NAC) platform. OnGuard runs on managed endpoints and enforces posture and access policy. Because the described outcome is root-level privilege on the ClearPass OnGuard deployment, the attack surface is the newly authenticated, remotely reachable service or interface exposed by the OnGuard agent rather than a pre-authentication remote surface.

Insufficient technical detail is available to identify the exact flawed function, request handler, inter-process communication path, or configuration element. The CNA title is empty and the affected-version list is empty in the provided data. No CWE assignment, patch, or workaround is supplied. Any implementation-level explanation beyond what is quoted above would be speculation and is therefore omitted.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the CVSS vector, not from a published PoC. No public PoC available; attack chain is inferred from vulnerability class.

1. Reconnaissance / target identification The attacker identifies an exposed ClearPass OnGuard agent endpoint that can be reached over the network (consistent with AV:N). Because privileges required is Low, the attacker must first possess valid low-privileged credentials or an authenticated session for the affected OnGuard deployment. Reconnaissance would therefore focus on locating reachable OnGuard agent services and confirming that an authenticated low-privileged context can be established.

2. Triggering the specific flaw class With an authenticated low-privileged session in place, the attacker sends crafted requests to the vulnerable OnGuard component. The vulnerability class is privilege escalation through improper privilege management (CWE-269): the agent fails to adequately constrain the privileges of actions available to an authenticated low-privileged user, allowing that user to perform an operation that should require higher privilege. The exact request path, parameter names, and code location are not disclosed in the provided data.

3. Payload / execution method (vulnerability-class level) The exploitation is an authorization/privilege-boundary bypass rather than a memory-corruption primitive. The attacker's payload is a crafted, authenticated request that the vulnerable component processes under an overly permissive security context. Because Attack Complexity is Low and User Interaction is None, no victim action and no complex preconditions are indicated.

4. Post-exploitation impact Successful exploitation allows the attacker to elevate their own privileges, potentially obtaining root privileges on the vulnerable ClearPass OnGuard deployment. With root, the attacker could perform unauthorized operations on the system and alter system integrity (I:H), which on a NAC deployment may extend to the integrity of posture and access decisions enforced by that agent. The vector claims no confidentiality (C:N) and no availability (A:N) impact.

Impact Assessment

• Business impact: A successful exploit grants an authenticated low-privileged attacker root-level control over a ClearPass OnGuard deployment. Because OnGuard is the endpoint enforcement point of a ClearPass NAC environment, root on that component can undermine the integrity of endpoint access/posture enforcement, which is a core trust control for network admission.
• Affected systems: ClearPass OnGuard agent deployments. No specific version range is provided in the available data; administrators should treat all ClearPass OnGuard agent instances as potentially affected until a vendor reference is obtained.
• Blast radius: Limited to the exploited OnGuard deployment per Scope:Unchanged (S:U). The vector assigns no confidentiality or availability impact (C:N/A:N) and does not assert cross-scope impact. Impact is concentrated on integrity (I:H).
• Likelihood: No exploit code, PoC, or Nuclei template is known; no CISA KEV listing. This indicates no observed in-the-wild exploitation. EPSS has not been scored by FIRST.org, so no probabilistic exploitation estimate is available and none should be assumed.
• Severity rationale: CVSS 6.5 (Medium) reflects network reachability and low attack complexity, tempered by the requirement for low privileges (PR:L) and absence of user interaction.

Detection Guidance

The following rules are constructed to detect behavior consistent with authenticated privilege escalation against a ClearPass OnGuard agent. Because no request format, URI, or parameter is disclosed, detections emphasize process-context change, authentication state, and anomalous child-process behavior characteristic of the vulnerability class rather than specific signatures.

Sigma Rule

title: Potential Privilege Escalation via Authenticated Request to ClearPass OnGuard Agent
id: 7f3c9a21-4b6e-4d0a-9c2f-2a5e1d8b6f34
status: experimental
description: Detects processes spawned by the ClearPass OnGuard agent that transition to an elevated/root context, consistent with CVE-2026-73788 privilege escalation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73788
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/onguard'
      - '/OnGuard'
      - '/onguard-agent'
  selection_elevation:
    User|contains:
      - 'root'
    IntegrityLevel: 'system'
  condition: selection_parent and selection_elevation
falsepositives:
  - Legitimate onboarding by the OnGuard service at boot
level: high
tags:
  - attack.t1068
  - attack.privilege_escalation
  - cve.2026.73788

YARA Rule

rule CVE_2026_73788_ClearPass_OnGuard_Privesc_Artifact
{
    meta:
        description = "Detects artifacts consistent with ClearPass OnGuard privilege-escalation activity (CVE-2026-73788)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73788"
        severity = "high"
    strings:
        $onguard1 = "ClearPass OnGuard" ascii nocase
        $onguard2 = "OnGuard" ascii nocase wide
        $elev1 = "setuid" ascii
        $elev2 = "root:" ascii
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and 1 of ($onguard*)
        and 1 of ($elev*)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET [443,80] (msg:"CVE-2026-73788 Potential ClearPass OnGuard Authenticated Privilege Escalation Attempt"; flow:established,to_server; content:"POST"; http_method; content:"ClearPass"; http_header; content:"OnGuard"; http_header; nocase; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-admin; sid:202673788; rev:1; metadata:reference cve,CVE-2026-73788;)

Elastic Detection

sequence by user.name, host.name with maxspan=5m
  [authentication where event.outcome == "success" and user.name != null]
  [process where process.parent.name : ("onguard", "OnGuard") and process.user.id == "0"]

Splunk SPL Query

index=main sourcetype=linux:audit OR sourcetype=syslog
("ClearPass" OR "OnGuard")
| regex _raw="(?i)(uid=0|euid=0|escalat|privilege)"
| stats count values(host) as hosts values(user) as users earliest(_time) as first_seen by _raw
| where count > 3

Wazuh OSSEC Rule

<group name="clearpass,onguard,privilege_escalation,">
  <rule id="100738" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">OnGuard</field>
    <regex type="pcre2">(?i)privilege|escalat|uid=0|euid=0</regex>
    <description>CVE-2026-73788: Possible ClearPass OnGuard privilege escalation to root by authenticated user</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,cve_2026_73788,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version mapping is present in the provided data.

1. Immediate mitigations

• Restrict network reachability of ClearPass OnGuard agent services to only the networks and management hosts that require it; enforce segmentation and host-based firewalling (consistent with AV:N).
• Reduce the population of accounts capable of authenticating to the OnGuard deployment; apply least privilege and disable unused low-privileged accounts, since exploitation requires PR:L.
• Monitor for anomalous elevation of authenticated OnGuard sessions to root and alert on unexpected process ancestry from the OnGuard agent.
• Where feasible, run the OnGuard agent with the minimum OS privileges required, and confirm that low-privileged sessions cannot invoke privileged operations.

2. Patch / upgrade steps

• No patch is currently identified. Track the HPE Aruba Networking security advisory and support portal for ClearPass/OnGuard releases; the provided data contains no advisory URL and no fixed version.
• Do not assume a fixed version exists. Obtain explicit vendor confirmation of the affected range before scheduling upgrades.
• Maintain a configuration inventory of OnGuard agent versions to enable rapid scoping once a fixed release is published.

3. Long-term hardening

• Enforce strict authenticated-user privilege separation in the OnGuard deployment and review all actions available to low-privileged accounts.
• Apply zero-trust segmentation so that compromise of one OnGuard agent does not provide a pivot to ClearPass policy infrastructure.
• Integrate agent telemetry into a SIEM and retain audit logs of privilege changes for retroactive detection.
• Subscribe to vendor advisories and CISA KEV updates; re-evaluate severity and EPSS once FIRST.org publishes a score.

References

• NVD — CVE-2026-73788: https://nvd.nist.gov/vuln/detail/CVE-2026-73788
• MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• NVD — CVSS v3.1 specification (vector interpretation): https://nvd.nist.gov/vuln-metrics/cvss
• FIRST.org — EPSS (no score currently assigned for CVE-2026-73788): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-73788 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild evidence: None identified. No public PoC, exploit code, or Nuclei template is associated with CVE-2026-73788 in the provided data, and the CVE is not listed in CISA KEV.