Cross-Site Scripting Vulnerability in HPE Networking ClearPass Policy Manager
CVE-2026-79816

5.4MEDIUM

Key Information:

Vendor

HP (HP)

Status
Clearpass Policy Manager (cppm)
Vendor
CVE Published:
6 October 2026

What is CVE-2026-79816?

A security flaw in the client interface of HPE Networking ClearPass Policy Manager allows unauthenticated remote attackers to perform DOM-based cross-site scripting (XSS) attacks. This vulnerability could enable attackers to execute arbitrary scripts within the victim's browser context when they interact with the compromised client interface. Ensuring prompt updates and effective user training can mitigate potential exploitation risks.

Affected Version(s)

ClearPass Policy Manager (CPPM) 6.14.0

ClearPass Policy Manager (CPPM) 6.14.0

ClearPass Policy Manager (CPPM) 6.11.0 <= 6.11.15

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Internal security research (HPE Networking).
.