HPE ClearPass Policy Manager: Authenticated SQL injection in web management interface
Summary
SQL injection vulnerabilities in the web-based management interface of HPE ClearPass Policy Manager allow an authenticated attacker with low privileges to inject SQL commands. Successful exploitation could allow the attacker to run arbitrary database commands on the ClearPass instance and affect connected systems. The CVSS base score is 9.9 (critical) with the scope changed.
Affected
- ClearPass Policy Manager 6.11.0 to 6.11.15
- ClearPass Policy Manager 6.14.0
- Other branches: Unknown.
Fixed in
- ClearPass Policy Manager 6.11.16
- ClearPass Policy Manager 6.14.1
- Vendor advisory HPESBNW05158 rev.1 (6 October 2026). Exact fixed build numbers not independently confirmed.
Workaround
- No workaround needed if patched; patching is the fix.
- Until patched: restrict access to the web management interface to a dedicated management network.
- Remove unused operator accounts and review administrator logs.
Exploitation
- No exploitation in the wild confirmed as of research.
- Not listed in CISA KEV.
- No public proof of concept found; this does not prove none exists.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether ClearPass Policy Manager is deployed and whether the web management interface is reachable from untrusted networks (external scan).
- If exposed, treat as high priority and patch immediately; otherwise patch in the normal cycle.
- Also prioritise CVE-2026-76754 (unauthenticated SQL injection in the same advisory) if ClearPass is in use.
- Monitor administrator logs for unusual database-related requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05158 support.hpe.com
- CSA Singapore Alert AL-2026-139 www.csa.gov.sg
- RadioCSIRT CVE record cve.radiocsirt.org
- Vulners VulnRichment CVE-2026-79798 vulners.com
- OpenCVE CVE-2026-79798 app.opencve.io
- Security Online ClearPass vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:37.
Original description (NVD)
SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.