ClearPass Policy Manager contains an authenticated path traversal flaw in its command line interface, allowing a low‑privileged user to reference directories outside the intended scope and execute arbitrary commands with elevated system privileges. This results in total control over the underlying operating system, compromising confidentiality, integrity, and availability of the managed infrastructure.

The vulnerability is found in Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). No specific version range is listed, so all supported releases until further notice should be considered potentially affected until an official update is issued.

The CVSS score of 8.8 reflects a high‑severity exploitation risk. The EPSS score is not available, and the issue has not yet been listed in the CISA KEV catalog. An attacker must first authenticate with low privileges, after which the path traversal can be triggered remotely to gain elevated execution rights. Given the high CVSS and the ease of remote exploitation once credentials are available, the risk is significant for any system running the affected software.