HPE Networking ClearPass Policy Manager

CVE-2026-109618 / CVE-2026-109619, HPE Networking ClearPass Policy Manager: bulletin HPESBNW05171 lists 6.14.1 and 6.11.16 and below as affected by the PHP2Shell flaws and names hotfix patches for both (CVSS 3.1 9.8)

HPE Networking's bulletin HPESBNW05171, released on 2026-10-22 and revised on 2026-10-23 to cover hotfix releases, lists ClearPass Policy Manager 6.14.1 and below and 6.11.16 and below, both released on 2026-09-29, as affected by CVE-2026-109618 and CVE-2026-109619, the PHP flaws behind PHP2Shell, and scores each CVSS 3.1 9.8 with network access, no privileges and no user interaction (HPE Networking, 2026-10-23). The fix is a hotfix patch for 6.14.1 and one for 6.11.16, downloadable from the HPE Networking Support Portal; versions past end of maintenance are presumed affected and are not covered by the bulletin, and HPE has not assessed versions past end of support, which it says should be considered potentially impacted (HPE Networking, 2026-10-23).

HPE recommends confining the CLI and web management interfaces to a dedicated layer 2 segment or VLAN, or controlling them with firewall policy at layer 3 and above, and asks customers to consider removing guest portals and all management interfaces from public access until ClearPass instances have been upgraded to "a version providing some level of mitigation", which it names as 6.14.1 and 6.11.16, although the same bulletin lists 6.14.1 and 6.11.16 and below as affected and names the hotfix patches as the remediation (HPE Networking, 2026-10-23). Other HPE Aruba Networking products it does not list are not known to be affected, and for Mist products the bulletin points to a Juniper reference advisory (HPE Networking, 2026-10-23). CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 (CISA KEV, 2026-10-27); the bulletin itself says nothing about exploitation of ClearPass (HPE Networking, 2026-10-23).

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the… · Palo Alto reports active exploitation of PAN-OS management interfaces via PHP2Shell; 14… · NetScaler's PHP2Shell fix is out: 14.1-73.49, 13.1-64.32 and FIPS builds; restrict management… · PHP2Shell hits QNAP NAS before login: QTS, QuTS hero, QVR and TVR OS fixed, Notes Station 3 and… · PHP2Shell hits NetModule routers with no fix, macmon, Schneider, B&R, HMS, Wibu and Oracle… · Cisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco… · Camping.Care booking data stolen: TCS and a second campsite warn of WhatsApp fraud; PHP link…