CVE-2026-79798: Vulnerability in Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)

This vulnerability involves SQL injection flaws in the web management interface of HPE ClearPass Policy Manager. An attacker with low-privilege authenticated access can exploit these flaws to execute arbitrary SQL commands on the backend database. This could lead to full compromise of the database, including data disclosure, modification, or denial of service. The affected versions are 6.11.0 through 6.11.15 and 6.14.0. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to run arbitrary database commands, potentially leading to full compromise of the ClearPass Policy Manager's database. This compromises confidentiality, integrity, and availability of the system's data and operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management interface to trusted users only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks.