Multiple severe vulnerabilities have been identified in the ClearPass Policy Manager platform, posing significant risks to enterprise network access control infrastructure. The security flaws carry maximum CVSS scores up to 9.9 and impact the server web interface, API components, and client agent modules. Successful exploitation allows unauthenticated remote attackers to execute arbitrary code, bypass authentication mechanisms, gain administrative access, and execute arbitrary database queries. The vulnerabilities stem from unsafe deserialization of untrusted data, missing integrity verification, improper input sanitation leading to SQL injection, and format string flaws. Organizations utilizing affected network access control solutions face serious risks of full system compromise and unauthorized network access. Immediate remediation through software updates is strongly advised to safeguard network boundary controls.
CVE-2026-79798: Evaluated at CVSS 9.9, this vulnerability involves an authenticated SQL injection flaw within the web-based management interface. An attacker with low-privileged credentials can inject malicious database queries to execute arbitrary commands and extract sensitive system data. Compromise of the database integrity can lead to complete administrative takeover of the access control policies.[/subscribe_to_unlock_form]
Multiple severe vulnerabilities have been identified in the ClearPass Policy Manager platform, posing significant risks to enterprise network access control infrastructure. The security flaws carry maximum CVSS scores up to 9.9 and impact the server web interface, API components, and client agent modules. Successful exploitation allows unauthenticated remote attackers to execute arbitrary code, bypass authentication mechanisms, gain administrative access, and execute arbitrary database queries. The vulnerabilities stem from unsafe deserialization of untrusted data, missing integrity verification, improper input sanitation leading to SQL injection, and format string flaws. Organizations utilizing affected network access control solutions face serious risks of full system compromise and unauthorized network access. Immediate remediation through software updates is strongly advised to safeguard network boundary controls.
CVE-2026-79798: Evaluated at CVSS 9.9, this vulnerability involves an authenticated SQL injection flaw within the web-based management interface. An attacker with low-privileged credentials can inject malicious database queries to execute arbitrary commands and extract sensitive system data. Compromise of the database integrity can lead to complete administrative takeover of the access control policies.[emaillocker id="1283"]
CVE-2026-76750: Assigned a CVSS score of 9.8, this severe issue stems from untrusted data deserialization in the web management interface. An unauthenticated remote attacker can exploit this flaw across the network to execute arbitrary code with system-level permissions. Successful exploitation results in complete takeover of the central policy management server without user intervention.
CVE-2026-76751: Carrying a CVSS score of 9.8, this vulnerability exists due to missing integrity verification within the endpoint client agent module. An unauthenticated remote attacker can supply untrusted binaries or packages to achieve arbitrary code execution on connected endpoints. This exposes protected enterprise endpoints to remote system compromise and lateral movement risks.
CVE-2026-76752: Rated at CVSS 9.8, this security flaw consists of an authentication bypass mechanism in the management interface. An unauthenticated network-based attacker can circumvent established authentication controls to obtain full administrative access privileges. Unauthorized access allows total manipulation of network admission rules and access governance policies.
CVE-2026-76753: Evaluated at CVSS 9.8, this flaw involves improper handling of format strings within the central management platform. An unauthenticated attacker sending crafted input over the network can cause memory corruption and execute arbitrary code. Exploitation severely compromises system availability and confidentiality across the central deployment.
CVE-2026-76754: Assigned a CVSS score of 9.8, this vulnerability is an unauthenticated SQL injection flaw affecting server interface components. Attackers can leverage unsanitized inputs to interact directly with the underlying database infrastructure and achieve remote code execution. This poses immediate risks of full administrative escalation and complete system takeover.
CVE-2026-79796: Carrying a CVSS score of 9.8, this flaw allows an unauthenticated remote attacker to bypass authentication procedures. By circumventing access controls, unauthorized users can gain administrative rights across the management console. Exploitation compromises access management integrity and allows unauthorized network rule modification.
CVE-2026-79801: Rated at CVSS 9.8, this issue involves missing integrity verification mechanisms within the client endpoint agent. An unauthenticated remote attacker can deploy unauthorized code packages directly to endpoint instances running the agent. This results in arbitrary code execution and compromises endpoint security posture across managed environments.
Prompt application of software patches to secure releases is essential to mitigate these critical exposure vectors across network access infrastructure. Enforcing administrative access restrictions behind dedicated management segments provides additional defense against external exploitation attempts. Maintaining strict access control policies on policy servers minimizes exposure to unauthorized remote administrative access.
We recommend you to update ClearPass Policy Manager to version 6.14.1 or later or 6.11.16 or later.
The following reports contain further technical details:
[/emaillocker]