ClearPass Policy Manager EUVD-2026-93885

Exploitation requires a valid low-privileged authenticated account on the ClearPass Policy Manager web-based management interface (CVSS PR:L) - it is NOT a pre-authentication flaw, so an attacker must already possess or obtain interface credentials or a session. Beyond authentication, no special non-default feature or configuration is named in the description; any account able to reach a vulnerable input parameter in the management UI can inject SQL (AC:L, UI:N). The principal limiting factor is therefore the authentication requirement and the fact that the management interface should be network-restricted to administrative segments; exposure is amplified wherever the ClearPass management interface is broadly reachable or where low-privilege operator accounts are widely provisioned.

This is a genuine high-priority issue, not merely a high-CVSS outlier. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes a network-reachable, low-complexity SQL injection in the ClearPass Policy Manager web management interface requiring only low-privileged authentication, with full confidentiality/integrity/availability impact and a scope change - consistent with the description's claim that an attacker can run arbitrary database commands. The key mitigating signal is PR:L: a valid (even low-privileged) account on the management interface is required, so this is not a fully pre-authentication flaw, which materially narrows the exploitable population to users who already have some interface access (operators, delegated admins, or any foothold with console credentials). Critically, no EPSS score, no CISA KEV entry, and no POC indicator were supplied in the input, so there is no exploitation-probability or active-exploitation signal to corroborate the severity - the 9.9 rests entirely on the vendor-supplied CVSS vector and description. No SSVC decision data was provided. There is no conflict between the CVSS vector and the description: both agree on authenticated remote network exploitation. The practical risk is therefore 'patch promptly' driven by the severity and the appliance's role as a network access control chokepoint, tempered by the authentication requirement and the absence of any evidence of exploitation or public tooling.

A low-privileged authenticated user (or an attacker who has phished/compromised such credentials) logs into the ClearPass Policy Manager web interface and submits crafted input to a vulnerable parameter, injecting SQL that the backend database executes. Because exploitation yields arbitrary database commands with a scope change, the attacker can read or alter policy, authentication, and credential data underpinning the organization's network access control. No public exploit code was identified in the provided data, and AC:L indicates the injection is straightforward once authenticated.