{"id":"CVE-2026-76754","published":"2026-10-06T20:17:30.853","lastModified":"2026-10-08T04:17:39.790","description":"A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows unauthenticated attackers to conduct SQL injection attacks, potentially leading to arbitrary database command execution.","exploitability":"Exploitation is relatively straightforward given the unauthenticated nature and the ability to run arbitrary database commands.","blast_radius":"If exploited, the attacker could gain full control over the database, leading to data theft, corruption, or manipulation.","remediation":"Upgrade to ClearPass Policy Manager version 9.10.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","sql-injection","database","unauthenticated"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:43:34.626Z"}}