HPE ClearPass Policy Manager + AOS-S wave (~28 GHSAs): unauth ladder on the NAC brain¶

Wave in one line: unauthenticated primitive ladder on the NAC brain

Source: GitHub Security Advisories wave published 2026-10-06T21:32Z — ~28 GHSAs for HPE Networking ClearPass Policy Manager and ArubaOS-Switch (AOS-S) in one vendor bulletin window (HPE bulletins hpesbnw05158 for ClearPass, hpesbnw05156 for AOS-S). Related pages: Oct 1 wireless management-plane pre-auth wave (same Aruba ecosystem, AP/controller plane), Oct 2 UTMStack transport page (agent-fleet reasoning), Sept 15 KEV wave page (perimeter appliance validation posture).

Why this is durable: ClearPass is the network access control brain — it decides VLAN assignment, posture admission, and identity for every wired/wireless endpoint in the estate, stores RADIUS/EAP/IdP credentials, and pushes policy to an OnGuard agent fleet running elevated on every managed endpoint. It is the same credential-dense, agent-riddled appliance class as UTMStack and Zammad, and this wave puts a full unauthenticated primitive ladder on the management interface plus a second, network-facing attack surface on the endpoint agents themselves.

1. The management interface ladder (ClearPass)¶

Operator axes:

1. Pre-auth parse is the auth layer. Four distinct unauthenticated classes (deserialization, format string, SQLi, auth bypass) landed on the same management/API surface in one bulletin. Whenever unauthenticated input reaches a deserializer, a format sink, or a query builder, authentication never had a chance to be the boundary — memory-safety and injection bugs in the pre-auth parse path are equivalent to auth bypass on that route. Sweep posture for any appliance admin plane: treat every reachable route's parse layer as an untrusted-code surface, and prioritize products whose bulletin lists unauthenticated deserialization/format-string items — that combination says the interface layer processes attacker bytes before identity.
2. Path traversal as an authorization oracle, not a file reader (79809). The traversal "influences authorization decisions and role assignment" — the path value is steering the authorization input plane, and the outcome is an unintended role, not a disclosed file. Generalization: when a path/route/identifier is used for both dispatch and policy lookup, normalization differentials (encoding, separators, case, suffix drift) between the authorization lookup and the handler dispatch are role-confusion candidates. Decision table per API family: request path spelling → authorization-decision path → handler actually run → role assigned. (Same check-vs-use family as the Elasticsearch leg folded on the Sept 18 ignored-scope page this same wave.)
3. Low-privilege SQLi is the engagement-relevant SQLi. The wave carries unauth, admin-authenticated, and low-priv web-UI SQLi legs. On NAC appliances the "low-privileged" account is often handed to helpdesk/auditors/monitoring integrations; a low-priv DB-command primitive on the system that stores every user's network identity and every integration credential is a full-estate compromise. Enumerate every role tier's SQLi surface separately; do not merge the legs into one finding.
4. Stored XSS on a NAC admin UI is a token-steering pivot, not a browser nuisance: the admin context can change policy, and the Oct 1 wireless page's rule applies — policy-plane XSS ⇒ wire/VLAN authority. Proof stays as a harmless marker in a lab admin session.

2. The OnGuard agent fleet is a second network-facing attack surface¶

• Attack the agents, not the server. OnGuard runs elevated on every managed endpoint and takes work from the ClearPass plane. "Unauthenticated remote attacker" against an agent whose update/command channel lacks integrity verification means network-position attackers can target every domain-joined endpoint in the estate without ever touching the appliance. Red-team inference (state as inference in reports): once you hold the management/infrastructure VLAN that agents trust, agent-channel payloads are a fleet-wide delivery mechanism; the recon step is identifying agent listener ports/services on endpoints (local service enumeration on a foothold, agent binaries' update URL grammar) — validation only in labs or against expressly-scoped endpoints.
• Missing-integrity-verification recurs as its own class across this wiki (update channels, plugin signatures, this wave's three separate legs): any channel where the endpoint accepts code/config from a lower-trust network position and no signature/proof-of-origin check gates it. Audit rule for agent fleets: diff who can send to the agent vs what the agent will execute, and test the gap against your own lab agent.
• GHSA-4325-q6rc-wccx / CVE-2026-79797 rounds it out: Android client functionality invocable by untrusted sources (exported-component exposure, user-interaction info disclosure) — the mobile-client sibling of the same fleet surface.

3. AOS-S (ArubaOS-Switch) — the wired sibling of the Oct 1 wireless page¶

• Same lesson as the Oct 1 Instant ON page, one layer down: the access switch is the post-foothold prize. Own the access switch and you control port VLANs, see the wired segment every AP hangs off, and can redirect traffic for anything on the port. Recon: AOS-S banners/sysDescr via SNMP are the version fingerprint; batch-report vulnerable firmware like the AP fleet rule.
• HPE shipped Aruba-family bulletins (Instant ON late Sept, ClearPass + AOS-S now) in a single audit cycle — when one vendor product family gets a coordinated wave, re-sweep the vendor's sibling product families within the hour; the advisories share a bulletin pipeline and land in adjacent windows.

Version fingerprint and validation boundaries¶

• Fingerprint targets by product + firmware/release against the two HPE bulletins above (ClearPass release notes / AOS-S version strings; SNMP sysDescr, web console banner). GHSA CVSS fields were sparse at publication; severity here is from the advisory listings — re-check scores after GitHub enrichment.
• Authorized engagements only. The unauthenticated memory-safety legs (deserialization, format string, overflows) are crash-inducing and potentially appliance-bricking — a crashed ClearPass is a network-wide admission outage: bench/lab appliances only, never production NAC. Pre-auth proofs on production stop at version evidence, route/auth gating checks, and read-only disclosure markers. OnGuard agent execution work: lab agents in disposable VMs only. Stored-XSS and traversal-role proofs: lab instances, synthetic users, marker-only mutations. No public exploit reproduction; keep any captured agent-channel traffic to lab captures.