A command injection vulnerability exists in the ClearPass Policy Manager API, allowing an authenticated attacker with remote network access to execute arbitrary system commands. This flaw can vertically elevate privileges, granting the attacker administrative control over the host. The weakness aligns with improper escaping of system command arguments (CWE‑77), compromising confidentiality, integrity, and availability of the affected platform.

The vulnerability impacts Hewlett Packard Enterprise's ClearPass Policy Manager product. Specific affected releases are not enumerated in the advisory, so any deployment of ClearPass Policy Manager that has not applied the vendor’s security update remains exposed.

The CVSS v3 base score of 8.8 indicates high severity, and the EPSS score of 0.00736 indicates a very low but non‑zero exploitation probability. The vulnerability is not catalogued in CISA's KEV list. Attacks require API authentication; therefore, attackers must compromise or otherwise gain valid credentials. Once authenticated, they can exploit the injection vector to launch privileged commands, essentially achieving full administrative takeover.