ClearPass Policy Manager EUVD-2026-93895

Exploitation requires network access to the ClearPass Policy Manager API endpoint and the ability to send crafted requests containing path-traversal sequences; per PR:N no authentication is needed and per UI:N no user interaction is required, so default deployments exposing the management/API interface are reachable. The primary limiting factor is network exposure of the ClearPass API - deployments that restrict the management/API interface to isolated or trusted administrative networks (rather than broad or internet-facing access) substantially reduce reachability. Impact is bounded to influencing authorization decisions and obtaining an unintended role (partial C/I/A), not full system takeover.

This is a moderate-priority, broadly-reachable flaw rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is the strongest risk signal here: it is remotely reachable over the network, requires low attack complexity, needs no privileges, and no user interaction - meaning any attacker with network access to the ClearPass API can attempt it. The 7.3 score is held below critical because impact is only partial across the board (C:L/I:L/A:L, scope unchanged), reflecting that the attacker influences authorization decisions / gains an unintended role rather than achieving full compromise. Confidence-tempering gaps: no EPSS score was provided, so exploitation probability cannot be quantified; there is no CISA KEV entry, so there is no public-exploitation signal; and no POC was referenced, so weaponization maturity is unknown. The CVSS network vector is consistent with the description's explicit 'unauthenticated remote attacker' and 'API endpoint' language, so there is no signal conflict. Net: treat as a real patch priority for internet- or widely-network-exposed ClearPass deployments (it is a security-enforcement appliance, which raises the stakes of a role-assignment bypass), but absent EPSS/KEV/POC data it is not evidence of active mass exploitation.

An attacker with network reachability to the ClearPass Policy Manager API sends a crafted request containing path-traversal sequences to the vulnerable endpoint, without any credentials. By manipulating the traversal, the attacker influences the policy engine's authorization logic and is assigned a role they should not hold, gaining network access or privileges beyond their entitlement. No public exploit was identified at the time of analysis, so the scenario is inferred from the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the description.