A vulnerability exists in ClearPass Policy Manager that permits an authenticated remote attacker to inject arbitrary SQL commands through the web‑based management interface, giving the attacker the ability to execute database commands. The weakness enables the attacker to directly manipulate database entries, extract sensitive data, or alter system configuration, potentially leading to a full compromise of the system if the database user possesses administrative privileges.

The affected system is Hewlett Packard Enterprise ClearPass Policy Manager, the vendor product known as ClearPass Policy Manager. No specific version numbers are disclosed in the current advisory.

The CVSS score of 9.1 indicates a high‑severity flaw. The EPSS score is not available, so the current likelihood of exploitation is unknown, but the absence of a KEV listing suggests that no publicly known exploit has been documented. The attack vector is inferred to be a remote, authenticated access to the web interface, requiring valid credentials. A successful exploitation could allow arbitrary database command execution, with significant confidentiality, integrity, and availability consequences.