{"api_version":"1","generated_at":"2026-10-06T21:45:24+00:00","cve":"CVE-2026-79809","urls":{"html":"https://cve.report/CVE-2026-79809","api":"https://cve.report/api/cve/CVE-2026-79809.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-79809","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-79809"},"summary":{"title":"Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authorization Bypass","description":"An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role.","state":"PUBLISHED","assigner":"hpe","published_at":"2026-10-06 20:17:32","updated_at":"2026-10-06 20:17:32"},"problem_types":[],"metrics":[{"version":"3.1","source":"security-alert@hpe.com","type":"Secondary","score":"7.3","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.3","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","name":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","refsource":"security-alert@hpe.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79809","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79809","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","version":"affected 6.14.0 6.14.0 semver","platforms":[]},{"source":"CNA","vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","version":"affected 6.11.0 6.11.15 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Internal security research (HPE Networking).","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"affected","product":"ClearPass Policy Manager (CPPM)","vendor":"Hewlett Packard Enterprise (HPE)","versions":[{"lessThanOrEqual":"6.14.0","status":"affected","version":"6.14.0","versionType":"semver"},{"lessThanOrEqual":"6.11.15","status":"affected","version":"6.11.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"Internal security research (HPE Networking)."}],"descriptions":[{"lang":"en","value":"An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"providerMetadata":{"dateUpdated":"2026-10-06T19:17:12.017Z","orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe"},"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US"}],"source":{"advisory":"HPESBNW05158","discovery":"INTERNAL"},"title":"Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authorization Bypass","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"eb103674-0d28-4225-80f8-39fb86215de0","assignerShortName":"hpe","cveId":"CVE-2026-79809","datePublished":"2026-10-06T19:17:12.017Z","dateReserved":"2026-08-25T14:46:11.263Z","dateUpdated":"2026-10-06T19:17:12.017Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-06 20:17:32","lastModifiedDate":"2026-10-06 20:17:32","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"79809","Ordinal":"1","Title":"Unauthenticated Path Traversal in ClearPass Policy Manager API E","CVE":"CVE-2026-79809","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"79809","Ordinal":"1","NoteData":"An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role.","Type":"Description","Title":"Unauthenticated Path Traversal in ClearPass Policy Manager API E"}]}}}