CVE-2026-76754

{
  "etk_id": "ETK-2026-819",
  "cve_id": "CVE-2026-76754",
  "display_id": "CVE-2026-76754",
  "ghsa_id": "GHSA-qvwm-rf7f-hmh9",
  "euvd_id": "EUVD-2026-93881",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in ClearPass Policy Manager interface",
  "summary": "ClearPass Policy Manager instances exposing the affected interface are vulnerable to SQL injection. A remote attacker without authentication may be able to execute database commands if they can reach that interface.",
  "mitigation": "Restrict access to ClearPass Policy Manager interfaces to trusted administrative networks and isolate them from untrusted networks. Apply the vendor's security update when it is available for the deployed release.",
  "vendor": "hewlett packard enterprise (hpe)",
  "product": "ClearPass Policy Manager (CPPM)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 6.14.0, <= 6.14.0",
        ">= 6.11.0, <= 6.11.15"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "ClearPass Policy Manager (CPPM)",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0038,
  "epss_percentile": 0.3106,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.7971921,
  "t0_at": "2026-10-06T19:16:58.629000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-06T19:16:58.629000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T19:16:58.629000+00:00",
      "url": "https://github.com/advisories/GHSA-qvwm-rf7f-hmh9"
    }
  }
}