ClearPass Policy Manager: Authenticated path traversal in command line interface

Summary

An authenticated path traversal vulnerability in the command line interface (CLI) of HPE ClearPass Policy Manager allows a remote attacker with low-privileged valid credentials to access files outside the intended directories. According to the CVE record, successful exploitation can lead to arbitrary code execution with elevated privileges on the underlying operating system. ClearPass is a network access control platform, so a compromise can affect network access policy as a whole. Exploitation requires valid credentials; no exploitation is known as of the advisory date.

Affected

• HPE ClearPass Policy Manager 6.14.0 and earlier (per CVE record and HPE bulletin HPESBNW05158)
• Applicability to the 6.11.x branch: verify in the HPE advisory before deciding (the bulletin lists 6.11.15 and below unless noted otherwise)

Fixed in

• ClearPass Policy Manager 6.14.1 (as reported by Tenable and Securityonline)
• Fixed release for the 6.11.x branch: unconfirmed; Securityonline reports 6.11.16, verify in the HPE advisory table

Workaround

• No CVE-specific workaround known.
• General HPE guidance: restrict CLI and web management interfaces to a dedicated layer 2 segment or VLAN and/or control them with layer 3+ firewall policies, with accounting and logging of user activity.
• Reduce accounts with CLI or management access and monitor their activity.

Exploitation

• Not known to be exploited in the wild, according to HPE as of the advisory date.
• Not listed in the CISA KEV catalogue at the time of research.
• No public proof-of-concept exploit found.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Identify all ClearPass Policy Manager instances on 6.14.0 or earlier, and any on 6.11.x.
• Patch to 6.14.1 or later, or to the fixed release confirmed for your branch in the HPE advisory.
• Restrict access to CLI and web management interfaces to dedicated administrative networks; do not expose them to the internet.
• Review administrative and operator accounts, remove unneeded ones, and monitor CLI activity.
• Re-check the HPE advisory and CISA sources before change work, as the status may change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE Security Bulletin HPESBNW05158 support.hpe.com
• VulDB CVE-2026-79800 vuldb.com
• OpenCVE CVE-2026-79800 app.opencve.io
• Tenable Plugin 364196 www.tenable.com
• Securityonline: ClearPass Policy Manager vulnerabilities securityonline.info
• CISA Singapore alert AL-2026-139 www.csa.gov.sg
• CCB Belgium advisory on ClearPass Policy Manager ccb.belgium.be
• Strix AI CVE-2026-79800 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:36.