This vulnerability in HPE ClearPass Policy Manager (CPPM) version 6.11.0 involves the web interface, where an authenticated remote attacker could access directory information and execute arbitrary commands on the underlying OS. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is published and assigned CVE-2026-73787 but lacks an official remediation level or patch information from the vendor.

Successful exploitation could lead to full compromise of the affected system by allowing arbitrary command execution with high privileges, resulting in complete loss of confidentiality, integrity, and availability of the system. Directory information disclosure could also aid attackers in further attacks. However, exploitation requires authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the CPPM web interface to trusted administrators only and monitor for suspicious activity. Follow vendor communications for updates on patches or mitigations.