CVE-2026-79799 Hewlett Packard Enterprise (HPE) CVE debrief

Who should care

Defenders responsible for ClearPass Policy Manager instances, especially those with administrative users accessing the web-based management interface, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-79799 is a high-severity vulnerability in ClearPass Policy Manager that allows unauthenticated stored XSS attacks against administrative users. Defenders should prioritize verifying exposure, especially for versions 6.14.0 and 6.11.15 or earlier, and implement measures to prevent XSS attacks.

• Potential execution of arbitrary script code in administrative users' browsers
• Possible unauthorized actions within the affected interface context
• Required verification of ClearPass Policy Manager versions and exposure
• Necessity for input validation and output encoding implementation

Technical summary

The vulnerability exists in the web-based management interface of ClearPass Policy Manager, allowing an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user. Successful exploitation enables the attacker to execute arbitrary script code in the victim's browser within the context of the affected interface. The vulnerability affects ClearPass Policy Manager versions 6.14.0 and 6.11.15 or earlier. Defenders should prioritize verifying exposure of ClearPass Policy Manager instances and assess the feasibility of XSS attacks against administrative users.

Defensive priority

Defenders should prioritize verifying exposure of ClearPass Policy Manager instances, especially versions 6.14.0 and 6.11.15 or earlier, and assess the feasibility of XSS attacks against administrative users.

Recommended defensive actions

• Verify ClearPass Policy Manager version and assess exposure
• Restrict administrative access to the web-based management interface
• Implement input validation and output encoding for user-supplied data
• Monitor for suspicious activity and implement a web application firewall (WAF) if possible
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD provide official records of the vulnerability. Hewlett Packard Enterprise (HPE) is the affected vendor. Versions 6.14.0 and 6.11.15 or earlier of ClearPass Policy Manager are affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.