Description
A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to execute arbitrary database commands.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | ClearPass Policy Manager (CPPM) | 6.14.0 – ≤ 6.14.0, 6.11.0 – ≤ 6.11.15 | — |
Advisories 1
- WID-SEC-2026-3762 Aruba ClearPass Policy Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2026