CVE-2026-79809: Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authorization Bypass
Published Oct 6, 2026
·Updated
An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role.
Affected Software
1 affected component
Aruba Networks ClearPass Policy Manager
Event History
Oct 6, 2026
CVE Published
via MITRE·07:17 PM
Data Sourced
via MITRE·07:17 PM
DescriptionSeverity
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
No authentication or prior privileges are required. The vulnerable API endpoint can be reached remotely, and exploitation does not require user interaction.
2
What is the practical impact of successful exploitation?
An attacker can influence authorization decisions and receive an unintended role. The reported impact includes limited compromise of confidentiality, integrity, and availability.