ClearPass Policy Manager EUVD-2026-93902

Exploitation requires the attacker to deliver crafted input to the specific vulnerable ClearPass Policy Manager client interface AND to induce a legitimate user of that interface to interact with it (UI:R) - typically by opening an attacker-supplied link, so the attack cannot succeed without victim participation. No authentication is needed by the attacker to craft the payload (PR:N), but the impact is confined to the targeted victim's browser session within the client interface and does not directly compromise the appliance or other users. Limiting factors: dependence on social engineering of a valid interface user, exposure of the affected client interface to the attacker's reach (greater risk if internet-facing), and the Low, session-scoped impact rather than persistent or server-side compromise.

This is a moderate-severity, moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, base 6.3) describes a network-reachable, low-complexity, unauthenticated flaw - but the UI:R requirement means a victim must be lured into interacting with attacker-controlled input, which substantially lowers real-world exploitability compared to a no-interaction bug. As a DOM-based XSS the impacts are correctly scoped as Low across C/I/A and limited to the victim's browser session within the client interface, not the underlying appliance. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation would require social-engineering a specific user rather than mass automated attack. One minor signal discrepancy: HPE assigned A:L to an XSS flaw, which is unusual since client-side script execution rarely degrades availability - this likely reflects conservative vendor scoring rather than a genuine DoS impact. Overall, prioritize patching as a standard remediation item, elevated for internet- or administrator-facing ClearPass interfaces, but below unauthenticated RCE or KEV-listed threats.

An attacker crafts a malicious URL or input targeting the vulnerable ClearPass client interface and delivers it to a legitimate user (e.g., an administrator or guest-portal user) via phishing or a planted link. When the victim opens it, attacker-controlled data is unsafely written into the DOM and arbitrary JavaScript executes in the victim's browser session within that interface. No public POC was provided in the input; exploitation hinges on the required user interaction (UI:R).