HPE ClearPass Policy Manager: Authenticated command injection in API
Summary
A command injection flaw in the API of HPE ClearPass Policy Manager does not properly neutralise special characters in user-supplied data before it is passed to operating system commands. An attacker with valid low-privilege credentials can exploit it remotely to escalate privileges and gain administrative control of the NAC server, which holds authentication and policy data for the network. The issue is rated CVSS 8.8 and is part of a bulletin that also contains more severe unauthenticated flaws.
Affected
- ClearPass Policy Manager 6.14.0 and earlier in the 6.14 branch
- ClearPass Policy Manager 6.11.15 and earlier in the 6.11 branch
- Versions of other branches are end-of-maintenance and are not patched by HPE.
Fixed in
- Version 6.14.1 for the 6.14 branch
- Version 6.11.16 for the 6.11 branch
- Fix mapping to be confirmed against the HPE bulletin HPESBNW05158, as the full advisory could not be verified.
Workaround
- Restrict access to the CLI and web management interfaces and the API to a dedicated management VLAN or trusted admin networks using firewall rules.
- Do not expose management or API interfaces to the internet or to guest/user networks.
- Enable accounting and logging of user activity.
- No specific vendor workaround exists for the API flaw itself.
Exploitation
- No known exploitation in the wild.
- Not listed in the CISA KEV catalogue; CISA SSVC: exploitation none, not automatable.
- EPSS below 1%.
- No public proof-of-concept found; this does not rule out that one exists.
Our recommendation
- Inventory all ClearPass Policy Manager instances and their versions.
- Patch affected branches to 6.14.1 or 6.11.16, applying the whole HPE bulletin HPESBNW05158 together, since it includes more severe unauthenticated flaws.
- Before rollout, test API automation: the fixed releases changed REST API token validation and some password-grant clients may fail until reconfigured.
- Until patched, restrict management and API access to trusted admin networks and check for internet exposure.
- Monitor administrative and API activity for unusual commands.
- Prioritise as high where affected versions expose management interfaces.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE advisory HPESBNW05158 support.hpe.com
- OpenCVE record (EPSS, KEV, CISA ADP) app.opencve.io
- VulDB entry vuldb.com
- Tenable plugin 364195 www.tenable.com
- ClearPass 6.11.16 known issues arubanetworking.hpe.com
- SecurityOnline roundup securityonline.info
- HPE upgrade paths support.hpe.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:37.
Original description (NVD)
A command injection vulnerability exists in the API of ClearPass Policy Manager. Successful exploitation could allow an authenticated remote attacker to escalate privileges and gain administrative control of the affected system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.