ClearPass Policy Manager EUVD-2026-93890

Exploitation requires the attacker to already hold valid low-privilege authenticated access to the ClearPass Policy Manager API (CVSS PR:L); it is not reachable by a fully unauthenticated attacker. Given that precondition, no user interaction and no special non-default configuration are indicated in the description - the flaw is in the API itself, so any deployment exposing the ClearPass management/API interface to an attacker-reachable network is affected. The primary limiting factors defenders can rely on are the authentication requirement and restricting network reachability of the management/API plane; the specific vulnerable API endpoint and affected versions are not enumerated in the provided data and should be confirmed from the HPE advisory.

This is a genuine high-priority issue for organizations running ClearPass Policy Manager, though not a drop-everything emergency absent evidence of active exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity, network-reachable attack requiring only low-privileged authentication and no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with the description's claim of privilege escalation to administrative control. The key risk amplifier is that ClearPass is a network access control (NAC) appliance sitting at a security-critical chokepoint, so administrative compromise is high-consequence. However, signals that would elevate urgency are absent from the input: no EPSS score was provided, KEV status is not indicated (treat as not listed), and no public exploit is referenced. The mitigating factor is the PR:L authentication requirement - an attacker must first possess valid low-privilege API credentials, which bounds the realistic attacker population to authenticated users, credential-theft scenarios, or chained access. In short: a real priority to patch given the appliance's sensitivity and low attack complexity, but with exploitation-probability data (EPSS) missing, urgency ranking should lean on the authentication precondition and the absence of confirmed in-the-wild activity rather than treating this as mass-exploited.

An attacker holding or obtaining low-privilege credentials for the ClearPass Policy Manager API sends a crafted request whose parameter smuggles an operating-system command into a vulnerable API handler, which executes it on the underlying appliance. By chaining this command execution, the attacker escalates from a limited API user to full administrative control of the NAC system. No public exploit code is identified in the provided data, so this scenario is inferred from the command-injection class and the CVSS vector rather than a known POC.