SQL injection vulnerabilities in the web‑based management interface of Hewlett Packard Enterprise ClearPass Policy Manager allow a low‑privileged authenticated remote attacker to execute arbitrary SQL commands against the underlying database. Successful exploitation could lead to unauthorized data disclosure, modification, or deletion, and depending on the database and permissions, could enable further compromise of the host system. The weakness is a classic injection flaw identified as CWE‑89.

The affected product is Hewlett Packard Enterprise ClearPass Policy Manager. No specific version numbers are listed, so all deployed instances of ClearPass Policy Manager are potentially impacted until a patch is applied.

The CVSS score of 9.9 indicates a critical severity, and the EPSS score of less than 1% suggests a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and the likely attack vector is a low‑privileged authenticated user accessing the web interface; the attacker requires only valid credentials for the management interface. Because exploitation can be performed remotely and enables arbitrary SQL command execution, the risk remains high.