ClearPass Policy Manager CVE-2026-79799

Exploitation targets the web-based management interface of ClearPass Policy Manager specifically. The injection itself requires no authentication (PR:N), but the payload only fires when an authenticated administrative user of that interface views the page containing the stored script (UI:R) - so the attacker must be able to reach the management interface over the network and must wait for or induce admin interaction. Practical risk is reduced where the ClearPass management interface is restricted to isolated management VLANs or trusted admin networks rather than broadly reachable, and where admin activity on the affected view is infrequent. There is no published exploit and no evidence of active exploitation to accelerate these conditions.

This is a credible, moderately high priority for organizations running Aruba/HPE ClearPass Policy Manager, but it is not a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated injection that nonetheless depends on an administrator interacting with the malicious stored content (UI:R), which materially limits reliability and speed of exploitation. No EPSS score, no CISA KEV listing, and no public POC were provided, so all available exploitation-likelihood signals point to no confirmed active exploitation and no published exploit code at this time - consistent with a flaw disclosed through the vendor (HPE) rather than discovered in the wild. One signal clearly conflicts with the vulnerability class: the input vector asserts S:U with C:H/I:H/A:H, yet a stored XSS executing script in a victim's browser normally implies a scope change (S:C) and does not typically produce a high availability impact - this looks like a vendor-conservative or template-driven scoring rather than a measured one, and the real-world impact is session/credential theft and admin-action hijacking, not host compromise. Net: treat as an important patch for an administrative security appliance, but the required admin interaction and absence of exploitation evidence place it below internet-facing unauthenticated RCE in queue priority.

An unauthenticated attacker submits crafted input (for example through a field or request handled by the ClearPass web management interface) that is stored and later rendered in the browser of an administrator who views the affected page. When the admin opens that page, the injected script runs in the context of the management interface, letting the attacker steal the admin session, perform actions as that administrator, or pivot into NAC policy configuration. No public exploit code was identified at time of analysis, and success hinges on an administrator viewing the poisoned content.