ClearPass Policy Manager CVE-2026-79810

Exploitation requires the attacker to already hold high-privilege (administrator-level) authenticated access to the HPE ClearPass Policy Manager management interface (CVSS PR:H), and to reach the affected interface over the network (AV:N). The primary limiting factor is this pre-existing administrative authentication - the flaw cannot be triggered by an unauthenticated or low-privilege user, so realistic exploitation depends on credential compromise, insider access, or chaining from a separate authentication/privilege flaw. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once admin access is held exploitation is reliable. The HPE advisory does not, in the provided data, name a specific non-default feature or configuration setting required; the affected 'interface' is the ClearPass management/administrative component.

This is a moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 base score of 7.2 (High) is driven by full CIA impact (C:H/I:H/A:H via OS-level command execution) and a network attack vector with low complexity, but it is tempered by the PR:H requirement - the attacker must already hold high (administrative) privileges on ClearPass Policy Manager. That single metric is the dominant risk-limiting factor: this is a post-authentication privilege-to-OS escalation, not an unauthenticated remote takeover. No EPSS score, CISA KEV listing, SSVC decision data, or POC availability was provided in the input, so exploitation likelihood cannot be quantified from the data; based on available signals this is 'no public exploit identified at time of analysis.' No signals conflict with each other - the CVSS vector (AV:N/PR:H) is consistent with the description ('authenticated remote attacker with high privileges'). The practical risk is that an admin-level account (legitimately held, stolen, or obtained via a separate flaw) can be converted into root-equivalent control of the appliance OS, which matters because ClearPass is a security-infrastructure NAC device. Missing data to verify: EPSS, KEV, and POC status are all absent and should be checked against CISA KEV and exploit trackers before final prioritization.

An attacker who already possesses high-privilege (administrator) credentials to the ClearPass Policy Manager interface - obtained through credential theft, insider access, or a prior compromise - sends crafted input to the affected management interface that is passed to the underlying OS. This allows execution of arbitrary commands as the appliance's OS user, converting administrative web access into full control of the host. No public exploit code was identified at the time of analysis, and the low attack complexity (AC:L) means exploitation is reliable once privileged access is held.