{"schema":"threatline.record/2","record":{"id":"CVE-2026-79809","aliases":[],"summary":"Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authorization Bypass","details":"An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role.","categories":["Unclassified"],"product":"ClearPass Policy Manager (CPPM)","vendor":"Hewlett Packard Enterprise (HPE)","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79809","source_modified_at":"2026-10-07T18:06:41.115Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"ClearPass Policy Manager (CPPM)","vendor":"Hewlett Packard Enterprise (HPE)","versions":[{"lessThanOrEqual":"6.14.0","status":"affected","version":"6.14.0","versionType":"semver"},{"lessThanOrEqual":"6.11.15","status":"affected","version":"6.11.0","versionType":"semver"}],"defaultStatus":"affected"}],"fixed_versions":[],"cvss":7.3,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00309,"percentile":0.2257,"score_date":"2026-10-23"},"published_at":"2026-10-06T19:17:12.017Z","modified_at":"2026-10-07T18:06:41.115Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-79809","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-07T18:06:41.115Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79809","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-07T18:06:21.703188Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T18:06:41.115Z","content_hash":"16fa3eba4e8ff99214406024982c2a16d73cf144a97b9290941fbb3ead1093c6"}}