HPE ClearPass Policy Manager: Authenticated path traversal vulnerability
Summary
An authenticated user of HPE ClearPass Policy Manager can exploit a path traversal flaw (CWE-22) to read and modify certain files on the underlying operating system. ClearPass controls network access and policy enforcement, so a compromise could affect authentication for the whole network. The CVSS 9.8 vector lists no privileges required, which conflicts with the authenticated description; the score may change after NVD analysis.
Affected
- HPE ClearPass Policy Manager 6.14.0
- HPE ClearPass Policy Manager 6.11.0 to 6.11.15
- Unsupported (End of Support) releases were not assessed by HPE
Fixed in
- 6.11.16 (to be verified against HPESBNW05158)
- 6.14.1 (to be verified against HPESBNW05158)
Workaround
- No vendor workaround known. HPE recommends patching.
- Interim measures only: restrict management access to trusted IP ranges, segment the management network, and monitor logs for encoded traversal sequences.
Exploitation
- HPE is not aware of public discussion or exploit code as of the advisory date.
- Not listed in CISA KEV.
- No confirmed in-the-wild exploitation found; this is unverified.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Inventory all ClearPass Policy Manager instances and their exact versions.
- Patch affected instances to 6.11.16 or 6.14.1, after confirming the fixed versions in HPESBNW05158.
- Remove internet exposure of the management interface and limit admin access to a management VLAN or specific IPs.
- Review admin accounts and logs for unusual file access or encoded traversal strings.
- Recheck NVD and CISA KEV, as the CVE is still awaiting analysis and the CVSS vector may change.
- Treat any internet-facing ClearPass as urgent because the same bulletin includes unauthenticated flaws.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05158 support.hpe.com
- CSA Singapore Alert AL-2026-139 www.csa.gov.sg
- Tenable Nessus plugin 364195 www.tenable.com
- VulnCheck/Vulners VULNRICHMENT CVE-2026-79805 vulners.com
- VulDB CVE-2026-79805 vuldb.com
- Strix CVE-2026-79805 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:55.
Original description (NVD)
An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.