This vulnerability in HPE ClearPass Policy Manager (CPPM) affects versions 6.11.0 and 6.12.0. It resides in the web-based management interface and permits an authenticated remote attacker to achieve remote code execution on the underlying OS. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is published and assigned CVE-2026-73769 but lacks an official remediation level or patch information from the vendor.

Successful exploitation allows an authenticated remote attacker to execute arbitrary commands on the operating system hosting the CPPM web interface. This can lead to full compromise of the system, affecting confidentiality, integrity, and availability of the service and potentially the broader network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the management interface to trusted administrators only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks.