ClearPass Policy Manager EUVD-2026-93882

Requires an authenticated session on the web-based management interface of Aruba/HPE ClearPass Policy Manager with privileges the vendor rates as high (PR:H) - i.e. administrative/management access to the appliance UI. The limiting factors are substantial: valid management-interface credentials are mandatory, no anonymous or unauthenticated path exists, and the ClearPass management interface is typically (and should be) restricted to a management network rather than exposed to the internet, so network reachability to that interface is itself a precondition. No user interaction is required (UI:N). The chief uncertainty is whether the vulnerable function is reachable by lower-privileged operator roles; if so, the effective barrier is lower than PR:H implies.

This is a genuinely high-severity issue but not an untriaged emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1 Critical) is driven largely by the scope change (S:C) and full C/I/A impact of arbitrary database command execution, not by ease of access - PR:H means the attacker must already hold high-privileged (administrative) credentials on the ClearPass management interface, which substantially gates real-world exploitation. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or imminent mass exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. The practical risk is therefore post-authentication privilege/impact escalation: an attacker who has compromised or been granted admin access to the management UI can escalate to full database control. Note a tension worth flagging: the vendor assigned PR:H, but the description only says 'authenticated' without specifying the privilege level - if lower-privileged operator roles can reach the vulnerable function, effective privilege would be PR:L and real-world exploitability higher than the gating suggests. Verify the exact required role with the HPE advisory.

An attacker who has obtained valid high-privileged credentials for the ClearPass Policy Manager web management interface (via phishing, credential reuse, or an insider) submits a crafted input to a vulnerable management function that is passed unsanitized into a SQL query. The injection lets them run arbitrary database commands, reading or altering policy, authentication, and configuration data. No public exploit code was identified at time of analysis, and no user interaction is required (UI:N).