ClearPass Policy Manager CVE-2026-79800

Exploitation requires the attacker to already hold valid low-privileged authenticated access to the ClearPass Policy Manager command line interface (PR:L); it is not exploitable by a fully unauthenticated attacker. The specific vulnerable component is the CLI, where a path traversal weakness allows escaping the intended file path context to execute arbitrary code with elevated OS privileges. Limiting factors: valid CLI credentials are mandatory, so blast radius depends on how broadly low-privilege appliance accounts are provisioned and on restricting network/management-plane access to the ClearPass CLI; no special non-default configuration or user interaction is indicated as required.

CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with the description's claim of arbitrary code execution with elevated OS privileges. No EPSS probability, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified and there is no public exploit identified at time of analysis. The signals are internally consistent (no CVSS-vs-description conflict), but the key mitigating factor is the PR:L requirement: an attacker must first obtain valid low-privileged CLI credentials, which makes this a strong post-authentication privilege-escalation/RCE risk rather than a wholly unauthenticated internet-spray threat. This should be treated as a genuine high priority for ClearPass operators - the privilege barrier is low and the appliance is a security-control chokepoint - but the absence of EPSS/KEV/POC data means active-exploitation urgency cannot be confirmed from the provided intelligence and should be verified against the HPE advisory and CISA KEV.

A low-privileged authenticated attacker - for example an operator with limited CLI access or someone who has phished/guessed appliance credentials - logs into the ClearPass Policy Manager command line interface and supplies crafted input containing path traversal sequences to a CLI command that mishandles file paths. The traversal lets the attacker read or write outside the intended directory and ultimately execute arbitrary commands with elevated (root/admin-level) privileges on the underlying OS, fully compromising the NAC appliance. No public exploit code was identified in the provided data.