ClearPass Policy Manager EUVD-2026-93897

Exploitation requires the attacker to already possess administrative privileges on the ClearPass Policy Manager instance and network reachability to its API (PR:H, AV:N). The specific prerequisite is authenticated admin-level access to the management/API interface - this is the primary limiting factor, confining the flaw to already-privileged insiders or attackers who have first compromised admin credentials. No user interaction and no special non-default configuration is indicated; the vulnerable API appears exploitable in standard deployments once admin authentication is held. Defenders can meaningfully reduce exposure by restricting management-interface network access and protecting admin credentials (MFA, least privilege).

This is a high-but-not-critical issue whose real-world risk is substantially gated by its privilege requirement. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms network-reachable, low-complexity exploitation with no user interaction, but PR:H means the attacker must already hold administrative credentials on the ClearPass Policy Manager instance - the description explicitly states 'remote authenticated attacker with administrative privileges.' An actor who already has admin access to a NAC policy appliance is already in a powerful position, so the SQL injection primarily provides a lateral capability (direct arbitrary database command execution, with full C:H/I:H/A:H impact on the database) rather than a primary initial-access vector. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation-likelihood signals cannot be evaluated; absence of these is not evidence of safety but does mean there is no indication of active or widespread exploitation at this time. The signals are internally consistent - network vector matches an API-exposed flaw, and PR:H matches the admin-only description - so there is no CVSS-vs-description conflict to flag here. Overall: a legitimate patch-worthy issue for ClearPass operators, but the admin prerequisite places it below internet-facing unauthenticated flaws in triage priority.

An attacker who has already obtained ClearPass Policy Manager administrative credentials (via phishing, credential reuse, or a prior compromise) sends a crafted request to the vulnerable API endpoint, injecting SQL that the backend executes directly against the policy database. This lets them read or tamper with authentication/authorization policy data or execute arbitrary database commands. No public exploit code was identified at time of analysis, and low attack complexity (AC:L) means a knowledgeable authenticated admin could reproduce it reliably.