A remote unauthenticated attacker can store malicious script in the web‑based management interface of ClearPass Policy Manager and later trigger its execution in the context of an administrative user's browser. The attacker can then execute arbitrary code, steal session data, or compromise the interface. This flaw is a stored XSS that compromises confidentiality, integrity, and availability of the affected interface.

The vulnerability affects Hewlett Packard Enterprise ClearPass Policy Manager. No specific version information was supplied in the CNA data.

The CVSS score of 8.8 indicates high severity, but EPSS data are unavailable, so the likelihood of exploitation is uncertain. The vulnerability is not listed in CISA KEV. It is likely to be exploited over the network by unauthenticated users who can access the management interface. Without proper mitigation, the flaw enables persistent code execution on the victim’s browser.