Description
A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to execute arbitrary database commands.
Published: 2026-10-06
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

A SQL injection flaw exists in the ClearPass Policy Manager API that can be triggered by a user with administrative privileges. The vulnerability permits the execution of arbitrary database commands, which can lead to remote code execution and compromise the confidentiality, integrity, and availability of the affected system. This weakness is classified as CWE‑89.

Affected Systems

Hewlett Packard Enterprise ClearPass Policy Manager is affected. No specific version information is provided, so all deployments of this product should be considered at risk until further details are available.

Risk and Exploitability

The CVSS score of 7.2 indicates a high severity. Exploitation requires a valid administrative account and remote API access, suggesting a network‑based, authenticated attack vector. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, but the combination of a high CVSS score and the ability to execute arbitrary database commands indicates a significant risk if not mitigated.

Generated by OpenCVE AI on October 6, 2026 at 22:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest HPE ClearPass Policy Manager patch or upgrade to the most recent version as recommended by HPE
  • Restrict API access by limiting exposure to internal networks or trusted IP ranges only
  • Ensure administrative accounts follow the principle of least privilege and consider disabling or tightly controlling any unnecessary admin roles

Generated by OpenCVE AI on October 6, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) clearpass Policy Manager (cppm)
Vendors & Products Hewlett Packard Enterprise (hpe)
Hewlett Packard Enterprise (hpe) clearpass Policy Manager (cppm)

Tue, 06 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-89

Tue, 06 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to execute arbitrary database commands.
Title Authenticated SQL Injection allows Remote Code Execution in ClearPass Policy Manager API
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Hewlett Packard Enterprise (hpe) Clearpass Policy Manager (cppm)
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-10-08T03:55:47.997Z

Reserved: 2026-08-25T14:46:11.264Z

Link: CVE-2026-79811

cve-icon Vulnrichment

Updated: 2026-10-07T18:07:24.219Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-06T20:17:32.720

Modified: 2026-10-08T04:17:51.437

Link: CVE-2026-79811

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T00:45:08Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')