LiveActive security incident?Get immediate response
CVE Record

CVE-2022-37877: A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to ele...

A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges. A successful exploit could allow these users to execute arbitrary code with root level privileges on the macOS instance in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address this security vulnerability.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This flaw affects Aruba ClearPass OnGuard on macOS and can let a malicious local user gain root-level control. It is not described as remote initial access. Business risk is highest where ClearPass OnGuard is deployed on managed Macs and users or attackers already have local access.

Executive priority

Treat this as a high-priority endpoint management risk, especially in Mac-heavy environments. It needs timely remediation, but the available evidence supports local privilege escalation rather than internet-scale remote compromise.

Technical view

CVE-2022-37877 is a local privilege escalation in the ClearPass OnGuard macOS agent associated with Aruba ClearPass Policy Manager 6.10.x through 6.10.6 and 6.9.x through 6.9.11. CVSS 3.1 is 7.8 with local access, low complexity, low privileges, no user interaction, and high confidentiality, integrity, and availability impact.

Likely exposure

Exposure is likely limited to organizations running affected Aruba ClearPass Policy Manager versions with the OnGuard macOS agent deployed. The source bundle does not identify other products, platforms, cloud services, or unauthenticated remote exposure.

Exploitation context

The CVE and vendor text describe a malicious user on a macOS instance escalating privileges to execute arbitrary code as root. CISA KEV status is false in the bundle, and no cited source states active exploitation.

Researcher notes

No CWE is provided in the bundle. The strongest technical signal is the CVSS vector: local attack, low complexity, low privileges, no user interaction, unchanged scope, and high CIA impact. Public sources here do not provide exploit details, indicators, or alternate mitigations.

Mitigation direction

  • Review Aruba advisory ARUBA-PSA-2022-013 for the vendor-approved upgrade path.
  • Upgrade affected ClearPass Policy Manager 6.10.x and 6.9.x deployments beyond vulnerable releases.
  • Prioritize Macs with the ClearPass OnGuard agent in higher-risk user populations.
  • If upgrade timing is constrained, check Aruba guidance before relying on compensating controls.

Validation and detection

  • Inventory ClearPass Policy Manager versions across production and non-production environments.
  • Identify macOS endpoints running the ClearPass OnGuard agent.
  • Confirm no deployment remains on 6.10.6 or below, or 6.9.11 or below.
  • Record upgrade evidence and affected endpoint coverage for audit tracking.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-37877 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2022-37877Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aAruba ClearPass Policy Manager6.10.x: 6.10.6 and below, 6.9.x: 6.9.11 and belowListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.