The vulnerability involves a missing integrity verification in the ClearPass Policy Manager agent, allowing an unauthenticated attacker to inject and execute trusted code on the client system. The lack of checksum or signature validation means that any data received from external entities can be altered or replaced, resulting in arbitrary code execution. This flaw directly compromises the confidentiality, integrity, and availability of the affected client machine by permitting full control of the system.

Affected systems include Hewlett Packard Enterprise ClearPass Policy Manager client agents. The product is Hewlett Packard Enterprise ClearPass Policy Manager. No specific version information is listed in the vulnerability report, so all installations of the client agent component are considered vulnerable until an official patch is released.

The CVSS score is 9.8, placing the vulnerability in the critical severity range. The EPSS score is less than 1% (approximately 0.00639), and it is not listed in the CISA KEV catalog, but the lack of a KEV listing does not imply lower risk. The likely attack vector is unauthenticated remote, inferred from the fact that the agent accepts data over network connections. Successful exploitation allows an attacker to execute arbitrary code on the victim system with the privileges of the agent process, potentially leading to full system compromise or lateral movement within the network.