{"id":"CVE-2026-79809","aliases":["EUVD-2026-93895","GHSA-x6vr-x995-pjqg"],"status":"published","title":"Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authorization Bypass","description":"An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0031,"percentile":0.24105,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-10-06T19:17:12Z","modified":"2026-10-07T21:33:24Z","products":[{"vendor":"hewlett packard enterprise (hpe)","product":"clearpass policy manager (cppm)"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us\u0026docLocale=en_US"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79809"},{"url":"https://github.com/advisories/GHSA-x6vr-x995-pjqg"}],"sources":{"cve":[{"id":"CVE-2026-79809","title":"Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authorization Bypass","description":"An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role.","status":"published","published":"2026-10-06T19:17:12.017Z","modified":"2026-10-07T18:06:41.115Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:50:38.739766Z"}],"euvd":[{"id":"EUVD-2026-93895","description":"An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role.","status":"published","published":"2026-10-06T19:17:12Z","modified":"2026-10-07T18:06:41Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T17:27:34.353796Z"}],"ghsa":[{"id":"GHSA-x6vr-x995-pjqg","title":"An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy...","description":"An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role.","status":"published","published":"2026-10-06T21:32:02Z","modified":"2026-10-07T21:33:24Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:12:55.347665Z"}],"nvd":[{"id":"CVE-2026-79809","description":"An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role.","status":"published","published":"2026-10-06T20:17:32.483Z","modified":"2026-10-07T19:17:43Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:54.809359Z"}]}}