An authentication bypass flaw exists in the API interface of ClearPass Policy Manager. The vulnerability allows a remote attacker to bypass existing authentication controls and access the API without credentials. Successful exploitation can lead to the disclosure of sensitive information stored or processed by the system, exposing data that could compromise confidentiality of network policies and device configurations.

The affected product is Hewlett Packard Enterprise's ClearPass Policy Manager. No specific version numbers are disclosed in the data, but any instance exposing the vulnerable API should be considered potentially impacted.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of < 1% indicates a very low likelihood of exploitation, so the risk remains moderate. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to identify the exposed API endpoint and send unauthenticated requests; the vulnerability does not require local or privileged access, implying a broad attack surface over the network.