ClearPass Policy Manager: Unauthenticated SQL injection
Summary
An unauthenticated remote attacker can exploit an SQL injection flaw in an affected interface of ClearPass Policy Manager. Successful exploitation can run arbitrary database commands, exposing sensitive data such as user credentials, policy configurations and audit logs. HPE rates the issue CVSS 9.8 and says it can lead to remote code execution, which is not stated in the CVE text itself. Whether the interface is reachable from the internet depends on the deployment.
Affected
- ClearPass Policy Manager 6.14.0
- ClearPass Policy Manager 6.11.0 to 6.11.15
- Earliest affected build in the 6.11 branch not confirmed. End-of-support releases not assessed; treat them as vulnerable.
Fixed in
- ClearPass Policy Manager 6.14.1 or later (6.14 branch)
- ClearPass Policy Manager 6.11.16 or later (6.11 branch)
- Verify the 6.11 fix against the full HPE bulletin HPESBNW05158 before relying on it.
Workaround
- Unknown. The HPE text retrieved does not list a workaround for this CVE.
- Generic measure from a third party: restrict access to the management and other exposed interfaces to trusted IP addresses through firewall rules. Apply in addition to patching, not instead of it.
Exploitation
- Not listed in the CISA KEV catalog.
- HPE states it is not aware of public discussion or exploit code as of the advisory date.
- Tenable lists no known exploits. No public proof of concept found in research; re-check.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Inventory all ClearPass Policy Manager instances and their versions.
- Upgrade to 6.14.1 or 6.11.16, or a later supported release, per HPE bulletin HPESBNW05158. Patch the whole critical batch in one maintenance window.
- Restrict management and any externally reachable interfaces to trusted sources.
- Review logs and database integrity for suspicious SQL activity or unexpected admin accounts, especially on instances exposed before patching.
- Re-check the HPE bulletin and NVD for updates, as NVD analysis is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05158 support.hpe.com
- Secure-ISS summary of HPE ClearPass critical vulnerabilities www.secure-iss.com
- Tenable plugin 364195 www.tenable.com
- VulDB CVE-2026-76754 vuldb.com
- CSA Singapore advisory AL-2026-139 www.csa.gov.sg
- OpenCVE CVE-2026-76754 app.opencve.io
- Vulners VulnRichment CVE-2026-76754 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:00.
Original description (NVD)
A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.