ClearPass Policy Manager EUVD-2026-93881

Exploitation requires network reachability to the ClearPass Policy Manager instance's affected interface (its management/web service); no authentication, credentials, or user interaction are needed per AV:N/AC:L/PR:N/UI:N, so default deployments exposing this interface are directly at risk. The input does not name the exact vulnerable endpoint, parameter, or any required non-default configuration, so the only confirmed limiting factor is network exposure of the interface - organizations that restrict the management interface to an isolated/trusted management network substantially reduce realistic attack surface, while any instance reachable from untrusted networks is exploitable pre-authentication.

All available signals point to this being a genuine, high-priority vulnerability rather than an inflated-CVSS edge case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, and the description independently corroborates each of these metrics ('unauthenticated remote attacker', SQL injection against the instance) - so the signals are consistent, not conflicting. The fully high C/I/A impacts are credible because SQL injection yielding arbitrary database commands can read, alter, and in many cases destroy policy/authentication data. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so exploitation probability and active-exploitation status cannot be confirmed from the supplied data; the absence of KEV/POC is NOT evidence of safety, merely missing intelligence. Because ClearPass Policy Manager is a network access control (NAC) component that often sits at the authentication chokepoint of an enterprise, an unauthenticated pre-auth SQLi of this class is historically a prime target and warrants prioritized emergency patching even without an EPSS or KEV signal.

A remote attacker with network access to the ClearPass Policy Manager management/web interface sends a crafted request to a vulnerable, unauthenticated endpoint, injecting SQL that the application concatenates into a database query. Because no authentication, privileges, or user interaction are required (AV:N/AC:L/PR:N/UI:N), the attacker runs arbitrary database commands to extract credentials/policy data or tamper with the backing store. No public exploit was identified in the provided data, but the low attack complexity makes reliable exploitation plausible once the endpoint is identified.