Paper/Archive/CVE-2026-79794

CVE-2026-79794

Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) — Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface

EPSS 0.3%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 22.4.224 × 204.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.

Affected

ProductAffectedFixed inSource

ClearPass Policy Manager (CPPM)6.14.0 – 6.14.0–CNA

ClearPass Policy Manager (CPPM)6.11.0 – 6.11.15–CNA

Scores by source

hpe (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US