HPE ClearPass Policy Manager: Authenticated SQL injection in web interface
Summary
An SQL injection vulnerability in the web-based management interface of HPE ClearPass Policy Manager allows an authenticated remote attacker to run SQL injection attacks against the instance. Successful exploitation could allow arbitrary database commands. The official CVE record and the CISA SSVC data indicate that the attacker needs a valid login, which is why exposure of the management interface and the strength of admin credentials matter most. The CVSS vector in the NVD/CNA data lists high privileges as required (PR:H), but this is not yet confirmed against the full HPE bulletin.
Affected
- ClearPass Policy Manager 6.14.0 and earlier
- ClearPass Policy Manager 6.11.0 to 6.11.15
Fixed in
- ClearPass Policy Manager 6.14.1
- ClearPass Policy Manager 6.11.16
- Note: these fixed versions come from secondary sources and must be verified against the HPE advisory HPESBNW05158 before rollout.
Workaround
No workaround documented in the sources reviewed. The vendor fix is to upgrade. Restrict access to the web management interface to a management network or VPN in the meantime.
Exploitation
- Not listed as known exploited (KEV).
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof of concept found in searches; this does not prove that none exists.
Our recommendation
- Patch to 6.14.1 or 6.11.16 after verifying the versions in the HPE advisory.
- Restrict web admin access to a management VLAN or VPN and block it from the internet.
- Enforce MFA on admin accounts and review existing admin accounts.
- Check logs for unusual database errors or queries.
- Review the other vulnerabilities in the same HPE bulletin, some of which are more severe.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05158 support.hpe.com
- Secure-ISS: HPE ClearPass Policy Manager critical vulnerabilities www.secure-iss.com
- OpenCVE: CVE-2026-79794 app.opencve.io
- Vulners VulnRichment: CVE-2026-79794 vulners.com
- VulDB: CVE-2026-79794 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:23.
Original description (NVD)
A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.