ClearPass Policy Manager EUVD-2026-93891

Exploitation requires an authenticated session to the ClearPass Policy Manager management interface (the description states 'authenticated'), which is the primary limiting factor despite the CVSS vector's PR:N. The attacker needs network reachability to that web/management interface - appliances with the admin plane restricted to trusted management networks substantially reduce exposure. No end-user interaction is required. The exact privilege level required (any authenticated user vs. an elevated role) is not specified in the available data and should be confirmed with HPE, as it materially changes real-world risk.

Signals conflict sharply and must be reconciled before prioritization. The input CVSS is 9.8 with vector AV:N/AC:L/PR:N/UI:N, but the description explicitly states this is an 'authenticated path traversal' - PR:N (no privileges) directly contradicts the word 'authenticated.' This mislabeling inflates the score: a correctly authenticated flaw (PR:L) would score roughly in the 8.x CVSS range, not 9.8. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation or widespread automated targeting at this time. The realistic risk is a post-authentication read/write primitive on a security-critical NAC appliance: serious for an environment where attackers can obtain valid (even low-privilege) ClearPass credentials, but materially lower than the 9.8 'remote unauthenticated' reading implies. Treat as a high-priority patch for an exposed management plane, but verify the authentication requirement with HPE before treating it as pre-auth RCE-equivalent: 'CVSS vector reports PR:N (unauthenticated) but the description says authenticated - verify privilege requirement with HPE.'

An attacker with valid (possibly low-privilege) credentials to the ClearPass Policy Manager web interface submits a crafted request containing directory-traversal sequences to reach files outside the intended directory, then reads sensitive configuration/credential material or modifies files on the underlying OS. No public exploit code was identified at time of analysis, and the attack is network-reachable but gated by the need for authentication.