A flaw exists in an interface of ClearPass Policy Manager that permits an unauthenticated attacker to inject arbitrary SQL statements. If successful, the attacker can execute any database commands the ClearPass database account permits, potentially modifying, deleting, or exfiltrating data stored in the system. The impact is limited to database operations, and further system compromise would depend on the privileges granted to the database account used by ClearPass.

Vulnerable HPE ClearPass Policy Manager (CPPM) installations that expose the affected interface are subject to this flaw. No specific product versions are listed in the advisory; therefore, any deployment of CPPM with the susceptible interface is considered at risk.

The CVSS score of 9.8 marks this flaw as critical, underscoring a severe security impact. The EPSS score of 0.00371 indicates a very low but non-zero probability that the vulnerability will be actively exploited in the wild, yet the lack of an authentication requirement still considerably increases risk. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit the flaw through unauthenticated network requests to the exposed interface, embedding malicious SQL payloads that the application then executes against its database.