SQL Injection Vulnerability in ClearPass Policy Manager by HPE
CVE-2026-79798

9.9CRITICAL

Key Information:

Vendor

HP (HP)

Status
Clearpass Policy Manager (cppm)
Vendor
CVE Published:
6 October 2026

What is CVE-2026-79798?

The ClearPass Policy Manager from HPE is susceptible to SQL injection vulnerabilities within its web-based management interface. This flaw enables low-privileged authenticated remote attackers to execute SQL queries against the database. If successfully exploited, this vulnerability allows attackers to manipulate the database, potentially leading to unauthorized data access and command execution. It's crucial for users to ensure that their instances are updated to mitigate this risk.

Affected Version(s)

ClearPass Policy Manager (CPPM) 6.14.0

ClearPass Policy Manager (CPPM) 6.14.0

ClearPass Policy Manager (CPPM) 6.11.0 <= 6.11.15

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Internal security research (HPE Networking).
.