CVE-2026-79809: Vulnerability in Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)

This vulnerability involves an unauthenticated path traversal issue in an API endpoint of HPE ClearPass Policy Manager. Exploiting this flaw allows a remote attacker without authentication to manipulate authorization logic, resulting in assignment of unintended roles. The CVSS 3.1 base score is 7.3, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Affected versions include 6.11.0 through 6.11.15 and 6.14.0 exactly.

An unauthenticated remote attacker can influence authorization decisions within ClearPass Policy Manager, potentially gaining unauthorized roles. This can lead to unauthorized access or privilege escalation, impacting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Users should monitor HPE advisories for updates and apply patches once available.