Paper/Archive/CVE-2026-76754

CVE-2026-76754

Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) — Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy Manager

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 32.5.325 × 206.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.

Affected

ProductAffectedFixed inSource

ClearPass Policy Manager (CPPM)6.14.0 – 6.14.0–CNA

ClearPass Policy Manager (CPPM)6.11.0 – 6.11.15–CNA

Scores by source

hpe (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsupport.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US