HPE ClearPass Policy Manager: Command injection in client software
Summary
A command injection flaw in the client software of HPE ClearPass Policy Manager (CPPM) allows arbitrary commands to be executed with elevated privileges on the affected host. The CVSS vector is network-based with low complexity and no privileges required, but it requires user interaction. An attacker must be able to supply crafted input to the affected software, so a user or client must be reached.
Affected
- HPE ClearPass Policy Manager 6.14.0
- HPE ClearPass Policy Manager 6.11.0 to 6.11.15
Fixed in
- 6.14.x: upgrade to 6.14.1 or later (per third-party sources, not yet verified against the HPE advisory)
- 6.11.x: upgrade to 6.11.16 or later (per third-party sources, not yet verified against the HPE advisory)
Workaround
Unknown. No vendor-documented workaround was found. Patching to the fixed release is the remediation path.
Exploitation
- Tenable lists no known exploits.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- HPE is not aware of any public discussion or exploit code as of the advisory date.
- No public proof of concept found. Status as of late October 2026.
Our recommendation
- Check whether CPPM 6.11.x (before 6.11.16) or 6.14.0 is in use and treat this as high priority.
- Patch according to HPE advisory HPESBNW05158, which also covers other flaws including CVE-2026-76750 (CVSS 9.8).
- Verify fixed versions against the HPE advisory before planning changes.
- Check whether the management or web interface is reachable from the internet and restrict access.
- Monitor HPE and CISA for updates and recheck exploitation status before acting.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05158 support.hpe.com
- Tenable plugin 364195 www.tenable.com
- SecurityOnline: ClearPass Policy Manager vulnerabilities securityonline.info
- VulDB CVE-2026-79802 vuldb.com
- Offseq radar CVE-2026-79802 radar.offseq.com
- Strix CVE-2026-79802 www.strix.ai
- Vulners CIRCL CVE-2026-79802 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:37.
Original description (NVD)
A command injection vulnerability exists in the client software of ClearPass Policy Manager. Successful exploitation could allow an attacker who is able to supply crafted input to the affected software to execute arbitrary commands with elevated privileges on the affected host.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.