External risk intelligence

ClearPass Policy Manager SQL Injection Allows Database Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-79798

ClearPass Policy Manager is a network access control solution that commonly utilizes a web-based management interface. These interfaces are frequently deployed in environments where they are network-reachable, and in many configurations, they act as edge or administrative services that are accessible over the network.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

SQL injection vulnerabilities have been identified in the web-based management interface of ClearPass Policy Manager. These flaws could allow an authenticated attacker to execute unauthorized database commands on the affected instances, potentially leading to significant data compromise or system manipulation.

Unauthenticated attackers can inject malicious commands.
It affects network access control systems.
Confirm if ClearPass Policy Manager is in use.

Attack Path

How an attacker could exploit the issue

A remote attacker with limited privileges could exploit SQL injection flaws within the ClearPass Policy Manager's web interface. By sending specially crafted requests, an attacker could manipulate database queries, potentially leading to the execution of arbitrary database commands.

Requires authenticated access.
Triggered via web interface.
Leads to arbitrary database commands.

Live Threat

Current exploitation, exposure, and threat context

SQL injection vulnerabilities in ClearPass Policy Manager's web interface could enable an authenticated remote attacker to execute arbitrary database commands, potentially affecting system data.

System data could be at risk.
Via authenticated remote SQL injection.
Arbitrary database commands may run.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership:

This vulnerability impacts ClearPass Policy Manager, a critical component for network access control. The initial focus should be on identifying all ClearPass instances within the environment. Once located, confirm their network reachability and business criticality to prioritize remediation efforts. Engaging the platform or infrastructure team responsible for ClearPass management is essential to confirm asset ownership and coordinate the next steps for risk mitigation and remediation.

Platform/Infrastructure team owns the issue.
Verify ClearPass instance reachability and criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ClearPass Policy Manager?

ClearPass Policy Manager is a network access control (NAC) solution. Organizations use it to manage, secure, and enforce policies for devices and users attempting to connect to their networks, acting as a gatekeeper for network resources.

What does SQL injection mean for CVE-2026-79798?

This is a vulnerability where the software fails to properly sanitize input in its web interface. It allows an attacker to insert their own commands into the system's database queries, potentially gaining unauthorized control over the database.

How is this SQL injection triggered?

An attacker must have low-privileged authenticated access to the web-based management interface to initiate the attack. Unauthenticated users cannot trigger this vulnerability simply by browsing the site; active credentials are required.

Do I need to worry if my system is internal?

Halo Surface Signal notes that while these interfaces are often edge services, any network-reachable instance is at risk. You should assess whether your management interface is accessible to any internal users or systems that could be compromised.

What should I do first to address this CVE?

Start by identifying all ClearPass Policy Manager instances in your environment. Once you have a list, work with your infrastructure or platform management teams to verify their current network accessibility and prioritize them for vendor-supplied updates.

References

support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.