CVE-2026-79809 Hewlett Packard Enterprise (HPE) CVE debrief

Who should care

Defenders responsible for ClearPass Policy Manager (CPPM) deployments, especially those using versions 6.14.0 and 6.11.15 or earlier, should assess exposure and potential impact. Defenders should verify exposure, especially for versions 6.14.0 and 6.11.15 or earlier, and assess potential impact on their deployments. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review compensating controls,

Why it matters

CVE-2026-79809 is a high-severity vulnerability in ClearPass Policy Manager that allows unauthenticated path traversal, leading to authorization bypass. Defenders should verify exposure, especially for versions 6.14.0 and 6.11.15 or earlier, and assess potential impact on their deployments.

• Potential unauthorized role assignment to attackers
• Increased risk of lateral movement within the network
• Possible exploitation of sensitive data access
• Verification of ClearPass Policy Manager version and patch level is required

Technical summary

The vulnerability exists in an API endpoint of ClearPass Policy Manager, allowing an unauthenticated remote attacker to influence authorization decisions by exploiting the path traversal vulnerability. Successful exploitation allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role. Hewlett Packard Enterprise (HPE) is the affected vendor. The CVE record was published on 2026-10-06T19:17:12.017Z and was last modified on 2026-10-07T18:06:41.115Z. Defenders should prioritize verifying exposure of ClearPass Policy Manager (CPPM) deployments, especially versions 6.14.0 and 6.11.15 or earlier, and assessing the potential impact of unauthorized role assignment.

Defensive priority

Defenders should prioritize verifying exposure of ClearPass Policy Manager (CPPM) deployments, especially versions 6.14.0 and 6.11.15 or earlier, and assessing the potential impact of unauthorized role assignment.

Recommended defensive actions

• Verify ClearPass Policy Manager (CPPM) version and assess exposure
• Review API endpoint access controls and authentication mechanisms
• Implement compensating controls to monitor and limit unauthorized role assignments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. The source item from cve_program_cvelist_v5 offers additional metadata. Defenders should verify exposure, especially for versions 6.14.0 and 6.11.15 or earlier, and assess potential impact on their deployments. The vulnerability exists in an API endpoint of ClearPass Policy Manager, allowing an unauthenticated remote attacker to influence authorization decisions by exploiting the path traversal vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.