{"id":"CVE-2026-76754","published":"2026-10-06T20:17:30Z","modified":"2026-10-08T04:17:39Z","title":"A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to…","vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","tier":"core","eol":null,"description":{"text":"A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.","provenance":"source","from":"NVD"},"summary":{"text":"A SQL injection flaw in an affected interface of HPE ClearPass Policy Manager (CPPM) lets an attacker inject crafted input into database queries. Exploitation requires only network reachability to the instance, with no authentication or user interaction, and it allows arbitrary database commands to be run.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:19:41Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00385,"percentile":0.32549,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 15, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6acf98726e4260f2f2ba3d49","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ace466c18a71dd7afa3f788","created":"2026-10-13"},{"name":"Known_Cve | Oct 13, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6accf723f346ce4b8a50d55a","created":"2026-10-12"},{"name":"Known_Cve | Oct 12, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6acba8a68a86c4d9508005a7","created":"2026-10-11"},{"name":"Known_Cve | Oct 11, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6aca554665c47eb24716f8f2","created":"2026-10-10"},{"name":"Known_Cve | Oct 10, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac90361476f45b4b982597d","created":"2026-10-09"},{"name":"Known_Cve | Oct 9, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac7b1a3f215e7af4290dc2e","created":"2026-10-08"},{"name":"Known_Cve | Oct 8, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac65e5b607642608f852c9a","created":"2026-10-07"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-93881","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93881","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-06","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76754","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":15.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":6.51,"detail":"percentile 0.3255"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}