CVE-2026-79811: Vulnerability in Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)

This vulnerability involves a SQL injection flaw in the API of HPE ClearPass Policy Manager. An attacker with administrative privileges who is authenticated remotely can exploit this flaw to execute arbitrary SQL commands on the backend database. This could compromise the database's confidentiality, integrity, and availability by allowing unauthorized data access or manipulation. The affected versions are 6.11.0 through 6.11.15 and 6.14.0. No information about available patches or vendor advisories is provided in the input data.

Successful exploitation could allow an attacker to execute arbitrary database commands, potentially leading to full compromise of the ClearPass Policy Manager's database. This impacts confidentiality, integrity, and availability of the affected system. The attacker must have administrative privileges and be authenticated remotely to exploit this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability requires administrative privileges and authentication, limiting administrative access and monitoring for suspicious activity may reduce risk until a patch is available.