CVE-2026-79799

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Hewlett Packard Enterprise (HPE)

Description

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-79799

EUVD

EUVD-2026-93886

Affected Vendors & Products

Vendor	Product	Version / Range
Hewlett	Packard	Enterprise (HPE) ClearPass Policy Manager (CPPM) 6.14.0
Hewlett	Packard	Enterprise (HPE) ClearPass Policy Manager (CPPM) 6.11.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the web-based management interface of ClearPass Policy Manager. An unauthenticated remote attacker could exploit it to inject malicious scripts that execute in the browser of an administrative user accessing the interface.

Detection Guidance

This vulnerability involves a stored XSS attack in the ClearPass Policy Manager web interface. Detection requires checking for suspicious input handling in the web interface or monitoring for unusual script execution in administrative sessions. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run arbitrary code in your browser within the context of the ClearPass Policy Manager interface. This could lead to session hijacking, unauthorized actions, or theft of sensitive data if you are an administrative user.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized script execution in a victim's browser, which may lead to data breaches or unauthorized access to sensitive information. The stored XSS attack could allow attackers to manipulate administrative interfaces, posing risks to data integrity and confidentiality.

Mitigation Strategies

Apply the latest security patches from HPE for ClearPass Policy Manager. Restrict access to the web-based management interface to trusted networks or IP addresses. Monitor administrative sessions for unusual activity and disable unused features.

Hi! I’m here to help you understand CVE-2026-79799. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70