CVE-2026-79812 Overview
CVE-2026-79812 is a denial of service vulnerability in the OnGuard agent of HPE Networking ClearPass Policy Manager. An authenticated local attacker can interrupt normal operation of the agent service by exploiting this flaw. ClearPass OnGuard performs endpoint posture assessment and health checks for network access control decisions, so disruption of the agent degrades endpoint compliance enforcement.
Critical Impact
An authenticated local user can disrupt the ClearPass OnGuard agent service, breaking endpoint posture checks that gate network admission and policy enforcement.
Affected Products
- HPE Networking ClearPass Policy Manager
- ClearPass OnGuard agent component
- Refer to the HPE Security Advisory for version-specific details
Discovery Timeline
- 2026-10-06 - CVE-2026-79812 published to NVD
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2026-79812
Vulnerability Analysis
The OnGuard agent runs on endpoints to evaluate posture, enforce compliance, and feed results to ClearPass Policy Manager for network access decisions. The vulnerability allows an authenticated local user to trigger a condition that interrupts normal operation of the agent service. Loss of agent availability prevents posture updates from reaching the policy engine, which can cascade into failed authentication flows, incorrect network segmentation decisions, or stale compliance state.
Exploitation requires local access and valid credentials on the affected host, limiting the vulnerability to insider or post-compromise scenarios. The impact is confined to availability of the OnGuard service, with partial integrity impact and no confidentiality exposure according to the published CVSS metrics.
Root Cause
HPE has not published root cause details in the public advisory. The behavior is consistent with improper input handling or resource management inside the OnGuard agent service when processing local requests from a lower-privileged user context. The HPE advisory is the authoritative source for component-level analysis.
Attack Vector
The attack requires local access to a system running the OnGuard agent and valid low-privilege credentials. No user interaction is required beyond the attacker's own session. The attacker interacts with the local agent interface or supporting IPC surface to drive the service into a failure or unresponsive state.
No public exploit code or proof-of-concept has been published for CVE-2026-79812. See the HPE Security Advisory for vendor-provided technical details.
Detection Methods for CVE-2026-79812
Indicators of Compromise
- Unexpected termination or repeated restarts of the ClearPass OnGuard agent service on managed endpoints
- Gaps in posture assessment telemetry arriving at ClearPass Policy Manager from previously healthy endpoints
- Local process crashes or error entries in OnGuard agent logs correlated with low-privileged user sessions
Detection Strategies
- Monitor service state transitions for the OnGuard agent process and alert on abnormal stop or crash events
- Correlate local user session activity with OnGuard service failures to surface attacker-driven disruption
- Baseline posture check frequency per endpoint and alert when a device stops reporting while the host remains online
Monitoring Recommendations
- Forward Windows and Linux service logs plus OnGuard agent logs to a central SIEM for correlation
- Track ClearPass Policy Manager authentication outcomes for a spike in posture-unknown or non-compliant results
- Alert on repeated agent restarts initiated by non-administrative local accounts
How to Mitigate CVE-2026-79812
Immediate Actions Required
- Review the HPE Security Advisory and identify affected ClearPass OnGuard versions in your environment
- Apply the HPE-provided update to the OnGuard agent on all managed endpoints as soon as it is validated
- Restrict interactive local logon on endpoints running OnGuard to trusted administrative accounts where feasible
Patch Information
HPE has published guidance under advisory hpesbnw05158en_us. Administrators should consult the advisory for fixed versions and deployment steps. No alternative vendor patch sources are listed in the NVD record for CVE-2026-79812.
Workarounds
- Limit the set of local users who can authenticate to endpoints running the OnGuard agent
- Monitor and auto-restart the OnGuard agent service to reduce the window of posture visibility loss
- Treat agent downtime as a policy decision input in ClearPass to avoid defaulting disrupted endpoints into permissive access roles
# Example: enable automatic restart for the OnGuard agent service on Windows
sc.exe failure "ClearPassOnGuard" reset= 86400 actions= restart/5000/restart/5000/restart/5000
sc.exe failureflag "ClearPassOnGuard" 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
