{"id":"CVE-2026-79794","published":"2026-10-06T20:17:30.967","lastModified":"2026-10-08T04:17:42.760","description":"A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability in ClearPass Policy Manager allows authenticated attackers to execute arbitrary database commands, posing a critical risk to the integrity and confidentiality of the database.","exploitability":"Exploitation requires an authenticated attacker with access to the web-based management interface, making it moderately hard to exploit.","blast_radius":"If exploited, this vulnerability could result in complete database compromise, leading to data theft or corruption.","remediation":"Upgrade to the latest version of ClearPass Policy Manager, as detailed in the vendor advisory.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","database","auth-required","critical"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:44:11.196Z"}}