ClearPass Policy Manager EUVD-2026-93884

Exploitation requires the HPE ClearPass Policy Manager Android client application to be installed on the victim's device, plus the presence of an untrusted source (a malicious co-installed app, or attacker-crafted intent/deep link/content) that can invoke the client's improperly access-controlled functionality. Victim user interaction is mandatory (UI:R) - the user must engage with the attacker-supplied content for the access-control bypass to fire. Limiting factors: the attack targets only end-user mobile devices running this specific Android client (not the ClearPass server), it yields information disclosure rather than system compromise, and the required user interaction plus app-installation prerequisite reduce exploitation reliability. The 'remote' characterization likely depends on an Android inter-component/deep-link delivery path rather than direct internet-facing exposure - confirm the precise delivery mechanism with HPE advisory hpesbnw05158en_us.

The input CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, but this vector is internally inconsistent with the description: the description states only that an attacker could 'obtain sensitive information,' which is a pure confidentiality impact, yet the vector claims High integrity AND High availability impact. The I:H/A:H ratings appear overstated and inflate the score - a confidentiality-only information-disclosure flaw would more realistically score in the mid-6 range. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' Exploitation also requires user interaction (UI:R), which meaningfully lowers real-world attacker reliability versus a zero-click bug. The 'remote' (AV:N) label combined with an Android client-app improper-access-control bug ('functionality may be invoked by untrusted sources') is ambiguous - this pattern typically reflects a malicious co-installed app or a crafted deep link/intent rather than classic internet-facing network reachability; verify the true attack vector (AV:N vs AV:L) with HPE advisory hpesbnw05158en_us. Net assessment: a credible but not urgent issue - no evidence of active exploitation, user interaction required, impact likely limited to information disclosure, affecting only users of the ClearPass Android client rather than the ClearPass server itself. Prioritize patching mobile clients but this is not a drop-everything server-side emergency.

An attacker publishes a malicious Android app (or crafts a malicious link/intent) that invokes exported functionality of the HPE ClearPass Policy Manager Android client. When a legitimate user with the ClearPass app installed interacts with the malicious content, the untrusted source triggers application functionality that leaks sensitive information back to the attacker. No authenticated session or elevated privileges are needed, but the victim must perform some interaction; no public proof-of-concept exploit has been identified.