External risk intelligence

ClearPass Policy Manager Authenticated Path Traversal Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-79805

ClearPass Policy Manager is typically deployed as an edge service or gateway to manage network access and authentication. Such appliances are commonly positioned to be reachable from the network segments they control, including potential exposure at the network perimeter or within distributed environments where they serve as centralized policy enforcement points.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in ClearPass Policy Manager that could allow unauthorized access to and modification of system files. This issue affects the security of network access and authentication controls managed by the product. The primary concern at this stage is to determine if ClearPass Policy Manager is deployed within your environment and assess the potential exposure.

System file access and modification is possible.
This impacts network access and authentication security.
Confirm relevance and exposure within your network.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by first gaining authenticated access to ClearPass Policy Manager. Once authenticated, they can manipulate the path to access and alter files on the system, potentially leading to significant compromise.

Authenticated access required.
Path traversal triggers vulnerability.
Allows file read/write.

Live Threat

Current exploitation, exposure, and threat context

An authenticated path traversal vulnerability in ClearPass Policy Manager could allow an attacker to read and modify files on the underlying operating system when supported by the advisory. This could potentially impact system integrity and the confidentiality of files accessible by the application.

System files could be affected.
Unauthorized file access and modification may occur.
Compromise of system integrity is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in ClearPass Policy Manager impacts authenticated users and requires immediate attention from infrastructure and security teams. The first practical step is to identify all deployed ClearPass Policy Manager instances, confirm their network exposure and business criticality, and assign ownership for remediation planning.

Infrastructure and Security teams own this issue.
Verify ClearPass Policy Manager network exposure.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ClearPass Policy Manager?

ClearPass Policy Manager is a network access control solution. It acts as a gatekeeper that authenticates users and devices before granting them access to network resources. It is used to enforce security policies and manage connectivity across enterprise networks.

What does path traversal mean in CVE-2026-79805?

Path traversal is a weakness where an application fails to properly sanitize user input used in file paths. In this vulnerability, it allows an authenticated user to escape the intended directory structure. This lets them access or modify sensitive system files they should not be able to reach.

How can this vulnerability be triggered?

An attacker must already have authenticated access to the system to trigger this bug. Simply sending a request from an unauthenticated state does not trigger the flaw. The path traversal occurs when a logged-in user submits specifically crafted inputs that manipulate how the system locates and processes files.

Do I need to worry about this if my instance is internal?

Yes. Halo Surface Signal notes that ClearPass Policy Manager often acts as a centralized enforcement point. While external exposure increases risk, internal placement does not remove it, as an attacker who has already breached another part of your network could target the appliance to escalate their access.

How should I start responding to this CVE?

Begin by creating a comprehensive inventory of all ClearPass Policy Manager instances in your environment. Once identified, evaluate their business criticality and verify their network placement. Use this information to coordinate with your infrastructure teams to prioritize and plan your remediation efforts.

References

support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.