A missing integrity verification check in the Windows client tool for ClearPass Policy Manager permits a malicious local user to elevate their privileges. Exploitation would grant the attacker the ability to run arbitrary code with higher privileges on the affected machine, potentially allowing full control of the system. The weakness is a failure to validate integrity before executing code, which directly undermines the principle of least privilege.

Systems running the Hewlett Packard Enterprise ClearPass Policy Manager Windows Client are impacted. The vulnerability applies to any installed version of the client software where the integrity verification step is absent; specific version ranges are not disclosed.

The CVSS score of 7.8 indicates a high severity for local attacks. EPSS score of 0.0011, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploitation yet. The likely attack vector is a locally authenticated user with sufficient access to the client, who would need to run malicious code to trigger the integrity bypass. Since the flaw is local, network attackers must first compromise or gain local access to the target system to leverage this weakness.