CVE-2026-79799

Executive Summary

CVE-2026-79799 is a stored cross-site scripting (XSS) vulnerability in the web-based management interface of ClearPass Policy Manager (Aruba, a Hewlett Packard Enterprise company). An unauthenticated remote attacker can inject malicious script that executes in the browser of an authenticated administrative user who views the affected interface. Successful exploitation allows arbitrary script execution in the context of the management interface, enabling session theft, credential capture, and administrative actions performed under the victim's privileges. The vulnerability carries a CVSS v3.1 base score of 8.8 (High), and no patch, PoC, or exploit code is currently available from tracked sources.

Technical Analysis

The vulnerability class is stored (persistent) cross-site scripting, assigned to the general CWE-79 family. The affected component is the web-based management interface of ClearPass Policy Manager. According to the NVD description, the flaw permits an unauthenticated remote attacker to conduct a stored XSS attack against an administrative user of that interface. This combination is significant: the attacker requires no prior credentials to inject malicious content, while the trigger condition is the administrative user's browser rendering the stored payload.

Stored XSS differs fundamentally from reflected XSS in that the malicious payload is persisted by the application — typically in a backend datastore, log, configuration field, or queue — and served back to victims on a later request. In a management interface context, this means the injected script survives beyond the initial request and can affect multiple administrative sessions until the tainted data is removed or sanitized. The exact injection point, persistence mechanism, and encoding path are not specified in the CNA title or NVD description provided; no function names, API endpoints, request parameters, or file paths are documented in the source data. Any claim about a specific parameter or handler would be speculative.

The unauthenticated nature of the injection vector implies the vulnerable surface is reachable before authentication — for example, a pre-authentication endpoint, login-adjacent page, or guest-facing workflow whose content is later displayed to administrators. However, the source data does not confirm which surface this is, so the mechanism should be treated at the class level only.

Exploitation constraints align with the CVSS vector. The attack is network-reachable (AV:N) and requires low complexity (AC:L) with no privileges (PR:N), but User Interaction is Required (UI:R) because the administrative victim must load the page containing the stored payload. Scope is Unchanged (S:U) — the script executes within the security context of the affected interface. Confidentiality, Integrity, and Availability impacts are all rated High (C:H/I:H/A:H), consistent with an administrative interface where a hijacked session can read sensitive policy data, alter configurations, and disrupt service.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. No specific function names, endpoints, or parameters are asserted, because none are present in the source data.

1. Reconnaissance / target identification. The attacker identifies an internet- or network-reachable ClearPass Policy Manager management interface. This is typically done via Shodan-style fingerprinting of the login page or HTTP response body, or through direct network enumeration. No authentication is required for this stage.

2. Injection of the stored payload. Because the injection vector is unauthenticated, the attacker submits crafted input to a pre-authentication, reachable surface of the interface. The application stores this input without adequate output encoding or sanitization. The precise endpoint, parameter, and storage location are unknown from the available data.

3. Trigger (payload execution). An authenticated administrative user later views the page, panel, log view, or workflow that renders the stored, unsanitized content. The victim's browser parses the injected markup and executes the attacker's script in the origin/context of the management interface. Given the CVSS vector's UI:R, this victim interaction is the trigger condition.

4. Post-exploitation impact. The executed script runs with the privileges and origin of the management interface. Class-level outcomes include: exfiltration of session tokens and cookies (subject to cookie flags not documented here), capture of credentials entered into the interface, issuance of authenticated requests on the victim's behalf (e.g., modifying policy configuration), and potential redirection or phishing within the trusted UI. The C:H/I:H/A:H ratings reflect that administrative-context code execution against a policy management platform can compromise confidentiality, integrity, and availability of the managed environment.

Because no exploit code or advisory detail exists, all payload specifics are deliberately omitted.

Impact Assessment

ClearPass Policy Manager is a network access control (NAC) and policy management platform that centralizes authentication, authorization, and device posture decisions. It commonly integrates with directory services, RADIUS, TACACS+, and endpoint agents. A stored XSS that executes in an administrator's browser therefore matters beyond the web tier: an attacker who hijacks or rides an administrative session can potentially alter policy rules, add or modify accounts, change authentication sources, or exfiltrate configuration and credential material visible to that admin.

• CVSS base score: 8.8 (High), CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
• Confidentiality (High): administrative session data, policy definitions, and any secrets rendered in the interface are exposed.
• Integrity (High): authenticated state-changing requests can be issued under the victim's context.
• Availability (High): misconfiguration or destructive administrative actions can disrupt NAC enforcement, potentially affecting network access for the entire managed estate.
• Blast radius: scoped to the affected ClearPass deployment and its managed endpoints; the S:U rating indicates the impact does not formally cross a security authority boundary under CVSS scoring, but operational impact can be broad because a single administrative compromise can cascade to all policy-enforced clients.
• Exploitability: EPSS has not yet been scored by FIRST.org; CISA KEV does not list this CVE; no PoC or exploit code is tracked.

Detection Guidance

Sigma Rule

title: Potential Stored XSS Injection Attempt Against ClearPass Policy Manager
id: 8b6f1c2e-4d7a-4a0e-9c31-7e5f2a9d1b44
status: experimental
description: Detects suspicious script-like payloads submitted to the ClearPass Policy Manager web interface, consistent with stored XSS injection attempts (CVE-2026-79799).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79799
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '<svg'
      - 'document.cookie'
  selection_target:
    cs-uri-stem|contains:
      - 'ClearPass'
      - 'cppm'
      - 'tips'
  condition: selection_method and selection_payload and selection_target
falsepositives:
  - Legitimate administrative content containing markup
  - Security scanners and penetration tests
level: high
tags:
  - attack.t1059.007
  - cve.2026-79799

YARA Rule

rule CVE_2026_79799_ClearPass_Stored_XSS
{
    meta:
        description = "Detects stored XSS payload artifacts targeting ClearPass Policy Manager management interface (CVE-2026-79799)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79799"
        severity = "high"

    strings:
        $xss1 = "<script" nocase ascii wide
        $xss2 = "javascript:" nocase ascii wide
        $xss3 = "onerror=" nocase ascii wide
        $xss4 = "onload=" nocase ascii wide
        $xss5 = "document.cookie" nocase ascii wide
        $xss6 = "XMLHttpRequest" nocase ascii wide
        $app1 = "ClearPass" ascii wide
        $app2 = "Policy Manager" ascii wide

    condition:
        (uint16(0) == 0x3C3F or uint16(0) == 0x0A0D or true) and
        any of ($xss*) and any of ($app*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79799 Possible ClearPass Policy Manager Stored XSS Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"ClearPass"; nocase; http.client_body; content:"<script"; nocase; http.client_body; content:"document.cookie"; nocase; reference:cve,2026-79799; classtype:web-application-attack; sid:202679799; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "POST" and
     stringContains(http.request.body, "<script") and
     (stringContains(url.path, "ClearPass") or stringContains(url.path, "cppm"))]
  [network where http.request.method == "POST" and
     stringContains(http.request.body, "document.cookie")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=stream:http
| eval uri=coalesce(uri_path, url)
| eval body=coalesce(form_data, request_body)
| where match(body, "(?i)<script|javascript:|onerror=|onload=|document\.cookie")
| where match(uri, "(?i)ClearPass|cppm|tips")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by uri, http_method
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-79799,">
  <rule id="202679799" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>ClearPass|cppm</match>
    <regex type="pcre2">(?i)(<script|javascript:|onerror=|onload=|document\.cookie)</regex>
    <description>CVE-2026-79799: Possible stored XSS injection attempt targeting ClearPass Policy Manager web interface</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>web_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or fixed version is documented in any tracked source. Until an official advisory and patch are published, treat the deployment as vulnerable and apply defensive controls.

1. Immediate mitigations

   • Restrict network access to the ClearPass Policy Manager management interface. Place it behind a management VLAN, VPN, or jump host; do not expose it directly to the internet. This directly negates the AV:N, PR:N injection path for external actors.
   • Enforce strict administrative segmentation and least privilege. Limit the number of accounts that can authenticate to the management UI, reducing the population of users who can trigger a stored payload.
   • Deploy WAF/virtual-patching rules that block script-tag and event-handler patterns in inbound requests (mirroring the Suricata/SPL logic above). Note that stored XSS defenses on input alone are imperfect; pair with output-side monitoring.
   • Set session cookies with HttpOnly, Secure, and SameSite flags where the platform allows, limiting token theft from a successful script execution.
   • Require administrative users to access the UI from hardened, fully patched browsers and to log out after use.

2. Patch/upgrade steps

   • Monitor the Aruba/HPE security advisory channels and the NVD entry for CVE-2026-79799. No fixed version is currently available; do not assume any released build is remediated.
   • When a vendor patch is published, schedule prioritized upgrades of ClearPass deployments, beginning with internet- or broadly reachable instances and those with high-value policy data.
   • After upgrading, re-validate the management interface and purge any persisted content that may contain previously injected payloads.

3. Long-term hardening

   • Move to a posture of never exposing NAC management planes to untrusted networks.
   • Implement centralized logging and alerting for the detection rules above, retaining web logs sufficient for post-incident forensics.
   • Adopt defense-in-depth: CSP headers where feasible, input validation and context-aware output encoding at the application layer (vendor responsibility), and continuous asset/patch tracking for network access control infrastructure.

References

• NVD — CVE-2026-79799: https://nvd.nist.gov/vuln/detail/CVE-2026-79799
• MITRE ATT&CK — T1059.007 (Command and Scripting Interpreter: JavaScript): https://attack.mitre.org/techniques/T1059/007/
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• CISA Known Exploited Vulnerabilities Catalog (verify current status; CVE-2026-79799 is not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• HPE Aruba Networking security advisories (monitor for a ClearPass Policy Manager advisory): https://www.arubanetworks.com/support-services/security-bulletins/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-79799 at the time of writing. No public PoC or exploit code is available.