CVE-2026-79797: Vulnerability in Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)

The vulnerability in HPE ClearPass Policy Manager's Android client is due to improper access control, where untrusted sources can invoke application functionality. This can lead to unauthorized information disclosure if an unauthenticated remote attacker tricks a user into interacting with the malicious source. The vulnerability affects versions >=6.11.0 <=6.11.15 and =6.14.0 of the CPPM Android client. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated remote attacker, with user interaction, to obtain sensitive information from the affected user. The impact is high on confidentiality, integrity, and availability, as indicated by the CVSS score of 8.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor HPE advisories for updates. Until a fix is available, limit exposure by restricting access to the affected Android client and exercising caution with untrusted sources that may invoke application functionality.