by Kastro
Paper/Archive/CVE-2026-79798

CVE-2026-79798

Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) — Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management Interface

EPSS 0.3%CVSS 9.9
critical.is priorityof 100
35
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 27.8.278 × 205.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.

Affected

ProductAffectedFixed inSource
ClearPass Policy Manager (CPPM)6.14.0 – 6.14.0–CNA
ClearPass Policy Manager (CPPM)6.11.0 – 6.11.15–CNA

Scores by source

hpe (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US