CVE-2026-79799: Vulnerability in Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)

This vulnerability exists in the web-based management interface of HPE ClearPass Policy Manager. An unauthenticated remote attacker can inject and store malicious script code that executes when an administrative user accesses the interface. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The affected versions are 6.11.0 through 6.11.15 and version 6.14.0.

An attacker exploiting this stored XSS vulnerability can execute arbitrary scripts in the browser of an administrative user, potentially leading to session hijacking, credential theft, or unauthorized administrative actions. This compromises the security of the management interface and could lead to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the management interface to trusted users and networks and consider additional protections such as web application firewalls to detect and block XSS payloads.