CVE-2021-26678

A remote unauthenticated stored cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface of ClearPass could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface.

• CWE-79

• https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txtVendor Advisory
• https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txtVendor Advisory

Published

Feb 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-26644SQL-Injection vulnerability caused by the lack of verificati…9.8
• CVE-2021-26673Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-26674Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-26675A stack-based buffer overflow in dnsproxy in ConnMan before …8.8
• CVE-2021-26676gdhcp in ConnMan before 1.39 could be used by network-adjace…6.5
• CVE-2021-26677A local authenticated escalation of privilege vulnerability …7.8
• CVE-2021-26679A remote authenticated command injection vulnerability was d…7.2
• CVE-2021-26680A remote authenticated command injection vulnerability was d…7.2
• CVE-2021-26681A remote authenticated command Injection vulnerability was d…7.2
• CVE-2021-26682A remote reflected cross-site scripting (XSS) vulnerability …6.1
• CVE-2021-26683A remote authenticated command injection vulnerability was d…7.2
• CVE-2021-26684A remote authenticated command injection vulnerability was d…7.2