HPE ClearPass Policy Manager: Unauthenticated stored cross-site scripting in web interface
Summary
A stored cross-site scripting (XSS) flaw in the web-based management interface of HPE ClearPass Policy Manager (CPPM) allows an unauthenticated remote attacker to inject script code. The script runs in the browser of an administrator who views the malicious content, in the context of the management interface. Successful exploitation requires an administrator to interact with the attacker's content, for example by opening a crafted link or page while logged in.
Affected
- HPE ClearPass Policy Manager 6.14.0 and earlier
- HPE ClearPass Policy Manager 6.11.0 to 6.11.15
Fixed in
- HPE ClearPass Policy Manager 6.14.1
- HPE ClearPass Policy Manager 6.11.16
- Conflict to verify: the HPE bulletin HPESBNW05158 contains the note "Fixed in 6.14.1 only" directly after this CVE. Check the per-CVE table in the bulletin before planning upgrades on the 6.11.x branch.
- A separate HPE bulletin (HPESBNW05171) lists ClearPass 6.14.1 and earlier as affected by PHP vulnerabilities. Check whether a further PHP fix is required.
Workaround
Unknown. No vendor workaround is published because fixed releases exist. Interim measure (not from the vendor): restrict access to the CPPM admin interface to a management network or VPN.
Exploitation
- CISA SSVC: exploitation none, not automatable, technical impact total
- Not listed in the CISA KEV catalogue
- No public proof of concept and no reports of in-the-wild exploitation known at the time of writing
- Absence of reports is not proof; continue monitoring
Our recommendation
- Confirm the current CPPM version of all instances
- Upgrade to 6.14.1 or 6.11.16 after resolving the fix conflict described above
- Apply the whole HPE bulletin HPESBNW05158, which contains other critical vulnerabilities, not only this CVE
- Restrict admin interface access to a management network or VPN
- Instruct administrators not to open untrusted links while logged in to CPPM
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05158 support.hpe.com
- HPE Security Bulletin HPESBNW05171 (PHP) support.hpe.com
- Singapore CSA Advisory AL-2026-139 www.csa.gov.sg
- ACN Italy: Vulnerabilities in HPE networking products www.acn.gov.it
- Tenable Nessus plugin 364195 www.tenable.com
- Secure-ISS: HPE ClearPass Policy Manager critical vulnerabilities www.secure-iss.com
- OpenCVE: CVE-2026-79799 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:36.
Original description (NVD)
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.