CVE-2026-79816

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Hewlett Packard Enterprise (HPE)

Description

A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting (XSS) attack against a user of the affected client interface. Successful exploitation could allow an attacker to execute arbitrary script code in a victim's browser context within the affected client interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-79816

EUVD

EUVD-2026-93902

Affected Vendors & Products

Vendor	Product	Version / Range
Hewlett	Packard	Enterprise (HPE) ClearPass Policy Manager (CPPM) 6.14.0
Hewlett	Packard	Enterprise (HPE) ClearPass Policy Manager (CPPM) 6.11.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a DOM-based cross-site scripting (XSS) flaw in the client interface of HPE Networking ClearPass Policy Manager. It allows an unauthenticated remote attacker to inject malicious scripts into web pages viewed by users of the affected interface. The attack occurs in the victim's browser context, potentially enabling the attacker to execute arbitrary code.

Detection Guidance

Detection of this DOM-based XSS vulnerability requires manual inspection of the client interface of HPE ClearPass Policy Manager. Check for improper input validation in web forms, URL parameters, or other user-input fields that may reflect untrusted data without proper sanitization. Use browser developer tools to inspect DOM elements and look for script execution in unexpected contexts.

Impact Analysis

If exploited, this vulnerability could allow an attacker to steal sensitive data like session cookies, perform actions on behalf of the user, or redirect the user to malicious websites. It may also lead to unauthorized access to the ClearPass Policy Manager interface or other connected systems.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR (General Data Protection Regulation) by exposing personal data or HIPAA (Health Insurance Portability and Accountability Act) by compromising protected health information. Non-compliance risks include fines, legal penalties, and reputational damage.

Mitigation Strategies

Apply the latest security patches from HPE for ClearPass Policy Manager immediately. Implement input validation and output encoding for all user-supplied data in the client interface. Use Content Security Policy (CSP) headers to mitigate XSS impact. Restrict access to the management interface to trusted networks only.

Hi! I’m here to help you understand CVE-2026-79816. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70