ClearPass Policy Manager CVE-2026-73769

Exploitation requires valid administrator-level credentials (high privilege, PR:H per CVSS) to the ClearPass Policy Manager web-based management interface. The attack is network-reachable (AV:N) with no user interaction (UI:N) beyond authentication. Limiting factors include the necessity to first obtain or compromise high-privilege admin credentials - this prevents unauthenticated or low-privilege exploitation. The management interface must be reachable from the attacker's position; environments that restrict management plane access to dedicated networks or VPNs substantially reduce the attack surface.

The provided CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects high-privileges-required exploitation, which significantly constrains the attacker population to those with administrator-level credentials. Despite full confidentiality, integrity, and availability impact on the host OS, the PR:H requirement means real-world risk is primarily from insider threats, credential theft, or pivot from a previously compromised admin account. EPSS data is not available. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog. The combination of network reachability and full OS-level impact makes this a priority patch for environments where CPPM admin credentials could be exposed, but the high privilege barrier substantially reduces automated or opportunistic exploitation risk.

An attacker who has obtained ClearPass Policy Manager administrator credentials - via phishing, credential reuse, or lateral movement from a compromised host - logs into the web management interface and submits a crafted request that triggers OS command execution on the CPPM appliance. With arbitrary command execution on the host, the attacker can exfiltrate the CPPM policy database, pivot to managed network segments, or establish persistence on the NAC infrastructure. No public exploit code has been identified at time of analysis.