High severity · published Oct 6, 2026
CVE-2026-79797
Improper Access Control in HPE Networking ClearPass Android Client Application
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invoked by untrusted sources. Successful exploitation could allow an unauthenticated remote attacker, with user interaction, to obtain sensitive information from the affected user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
ClearPass Policy Manager (CPPM) · Hewlett Packard Enterprise (HPE)
6.14.0 through 6.14.0; 6.11.0 through 6.11.15 · source: vendor
Affected product
CP
ClearPass Policy Manager (CPPM)
Hewlett Packard Enterprise (HPE)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-79797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-79797
support.hpe.com
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US
More from ClearPass Policy Manager (CPPM)
9.9
CVE-2026-79798
Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management Interface
9.8
CVE-2026-79805
Authenticated Path Traversal Vulnerability Leads to Unauthorized File Access and Modification in ClearPass Policy Manager
9.8
CVE-2026-79801
Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass Policy Manager Client Agent
9.8
CVE-2026-79796
Authentication Bypass Vulnerabilities in ClearPass Policy Manager
9.8
CVE-2026-76754
Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy Manager