CVE-2026-79800

Executive Summary

CVE-2026-79800 is an authenticated path traversal vulnerability in the command line interface of ClearPass Policy Manager (HPE Aruba Networking). A low-privileged, authenticated remote attacker can exploit insufficient path input validation to escape the intended CLI file context and execute arbitrary code with elevated privileges on the underlying operating system. With a CVSS base score of 8.8 and High confidentiality, integrity, and availability impacts, successful exploitation can yield full host compromise of a core network access control (NAC) platform.

Technical Analysis

The vulnerability is a path traversal (directory traversal) flaw, classified under CWE-22, that is reachable through the ClearPass Policy Manager command line interface. ClearPass Policy Manager is a network access control (NAC) appliance that performs authentication, authorization, and accounting (AAA), and it is typically deployed at trust boundaries — between wired/wireless clients and the corporate network, and integrated with identity sources such as Active Directory, LDAP, and RADIUS.

The NVD description states that the flaw is "an authenticated path traversal vulnerability" in "the command line interface." The attacker requires valid low-privileged credentials and remote network access to the management interface (CVSS vector AV:N). The user interaction requirement is None (UI:N), and exploitation does not require privileges beyond the low-privileged authenticated role (PR:L). The scope is Unchanged (S:U) — the vulnerable component and the impacted component are the same security authority, namely the ClearPass host operating system.

The attack mechanism at the vulnerability-class level is as follows: the CLI accepts user-supplied input that is used to reference a filesystem location without adequately canonicalizing or restricting path components. An authenticated user can supply crafted path sequences (path traversal sequences that escape the intended base directory) so that a file operation performed by the CLI resolves outside its intended directory. Because the CLI process on the appliance runs with elevated privileges on the underlying operating system, traversal to a location under the attacker's influence — or traversal that allows writing/loading of attacker-controlled content — can be leveraged to achieve arbitrary code execution with elevated privileges.

Important accuracy caveats: The NVD description does not disclose specific CLI command names, parameter names, file paths, URL endpoints, or the exact traversal token used. Those implementation specifics are not reproduced here because they are not present in the source data, and inventing them would be irresponsible. The remaining technical detail (which exact subcommand, which file operation, and which destination directory) is unavailable in the provided intelligence.

Root cause class: improper limitation of a pathname to a restricted directory ("path traversal," CWE-22). The vulnerability requires authentication, which lowers the attack surface but does not eliminate risk — a low-privileged account (for example, a helpdesk or read-only administrative account) is sufficient. No CWE was provided by the CNA in the dataset; CWE-22 is the mapping inferred from the explicit "path traversal" wording in the NVD description.

Exploitation Scenarios

Note: No public PoC, exploit code, or Nuclei template is available for CVE-2026-79800. The attack chain below is inferred from the vulnerability class (authenticated path traversal in a CLI) and the NVD description. No specific command names, paths, or parameters are fabricated.

1. Reconnaissance / target identification. The attacker identifies an internet- or management-network-reachable ClearPass Policy Manager instance. Because the flaw is in the command line interface, reachable via SSH, a console/serial interface, or an authenticated web-based CLI, the attacker must first locate an exposed management surface. The attacker then obtains or already holds valid low-privileged credentials (for example, a non-administrative operator account), consistent with the PR:L rating.

2. Authentication and CLI access. The attacker authenticates to the CLI with low-privileged credentials. No user interaction from another party is required (UI:N), and no special privileges beyond the low-privileged authenticated role are needed (PR:L).

3. Triggering the path traversal. Within a CLI operation that takes a user-controlled path as input, the attacker supplies a crafted path containing traversal sequences so that the resolved location escapes the intended directory. The precise command and file operation are not disclosed in the source data; at the class level, the flaw allows the attacker to reach filesystem locations the CLI is not intended to expose or to cause a privileged file operation to act on attacker-influenced content.

4. Execution with elevated privileges. Because the CLI operates with elevated privileges on the underlying operating system, the traversal is converted into arbitrary code execution in that elevated context (C:H/I:H/A:H). The attacker can then read sensitive configuration and credential material, modify appliance behavior, disrupt AAA services, or use the appliance as a pivot into the network it protects.

5. Post-exploitation impact. Compromise of a NAC appliance is high severity: the host typically brokers authentication and enforcement for the network. An attacker with elevated OS access can potentially tamper with authentication policy, harvest credentials and secrets, alter enforcement decisions, and establish persistence — directly affecting the confidentiality, integrity, and availability of the underlying platform and the network segments it governs.

Impact Assessment

CVSS 3.1 base score: 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

• Attack Vector (Network): exploitable remotely; no physical or adjacent access required.
• Attack Complexity (Low): no special conditions beyond valid credentials and reachability.
• Privileges Required (Low): a low-privileged authenticated account is sufficient. This is significant because helpdesk, operator, or read-only accounts are common in large deployments.
• User Interaction (None): no victim action is required.
• Scope (Unchanged): the exploited component and the impacted component are the same security authority — the ClearPass host OS.
• Confidentiality/Integrity/Availability (High): full loss of confidentiality (read secrets/credentials), integrity (arbitrary code execution, policy tampering), and availability (disruption of AAA services).

Business impact: ClearPass Policy Manager is a network access control platform used to enforce authentication and authorization for wired, wireless, and VPN access. Host-level compromise can undermine the organization's entire zero-trust and network segmentation strategy, expose identity integrations (AD/LDAP/RADIUS), and create a high-value pivot point into core networks. Blast radius extends beyond the appliance itself to every endpoint whose access is governed by it.

Exploitation likelihood: EPSS is not yet scored by FIRST.org, and there is no CISA KEV listing, no public PoC, and no public exploit code as of this report. The vulnerability is currently assessed as not observed exploited in the wild. Given the authenticated precondition, mass opportunistic exploitation is less likely than for an unauthenticated flaw; however, the low privilege requirement and high impact make it attractive for targeted attacks and post-compromise lateral movement by an adversary who already holds valid low-privileged credentials.

Detection Guidance

Sigma Rule

title: Suspicious Path Traversal Patterns in ClearPass Policy Manager CLI Activity
id: 8b1f6a2c-3d47-4e9a-9c2b-cve202679800
status: experimental
description: Detects path traversal sequences in command/CLI-related process arguments associated with ClearPass Policy Manager, indicative of CVE-2026-79800 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79800
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_traversal:
    CommandLine|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '..%2f'
      - '....//'
  selection_context:
    CommandLine|contains:
      - 'clearpass'
      - 'cppm'
      - 'policy-manager'
  condition: selection_traversal and selection_context
falsepositives:
  - Legitimate administrative scripts referencing relative paths
  - Package managers or configuration tooling using relative directories
level: high

YARA Rule

rule CVE_2026_79800_ClearPass_PathTraversal_Indicators
{
    meta:
        description = "Detects path traversal patterns within CLI-related content potentially associated with CVE-2026-79800 (ClearPass Policy Manager authenticated CLI path traversal)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79800"
        severity = "high"

    strings:
        $trav1 = "../../../" ascii
        $trav2 = "..%2f..%2f" ascii nocase
        $trav3 = "..\\..\\" ascii
        $trav4 = "%2e%2e%2f" ascii nocase
        $cp1   = "clearpass" ascii nocase
        $cp2   = "policy-manager" ascii nocase
        $cmd1  = "cpcli" ascii nocase

    condition:
        (any of ($trav*)) and (any of ($cp1, $cp2, $cmd1))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 22 (msg:"CVE-2026-79800 ClearPass Policy Manager CLI Authenticated Path Traversal Attempt"; flow:to_server,established; content:"../"; depth:512; content:"..%2f"; nocase; classtype:attempted-admin; reference:cve,2026-79800; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79800; sid:202679800; rev:1;)

Elastic Detection

process where event.type == "start" and
  (
    process.command_line : "*clearpass*" or
    process.command_line : "*cppm*" or
    process.command_line : "*policy-manager*" or
    process.command_line : "*cpcli*"
  ) and
  (
    process.command_line : "*../*" or
    process.command_line : "*..\\*" or
    process.command_line : "*%2e%2e*" or
    process.command_line : "*..%2f*"
  )

Splunk SPL Query

index=main (sourcetype=linux_secure OR sourcetype=syslog OR sourcetype=osquery) 
(process="*clearpass*" OR process="*cppm*" OR process="*cpcli*" OR process="*policy-manager*")
(command_line="*../*" OR command_line="*..\\*" OR command_line="*%2e%2e*" OR command_line="*..%2f*")
| stats count min(_time) as first_seen max(_time) as last_seen values(command_line) as commands by host, user, src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="clearpass,cve-2026-79800,">
  <rule id="202679800" level="12">
    <decoded_as>json</decoded_as>
    <field name="command_line">\.\./|\.\.\\|%2e%2e|\.\.%2f</field>
    <description>CVE-2026-79800: Possible ClearPass Policy Manager CLI path traversal exploitation attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_path_traversal,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or patch reference was provided in the tracked intelligence sources. No affected version range was published in the provided data. Treat any ClearPass Policy Manager deployment as potentially exposed and prioritize vendor communication.

1. Immediate mitigations:

• Do not expose the ClearPass Policy Manager CLI/management interface to untrusted networks (internet, guest, or any lower-trust segment). Restrict access to a dedicated, tightly scoped administrative management network.
• Enforce least privilege on CLI and administrative accounts. Audit all low-privileged accounts; disable unused ones. Because the flaw requires only a low-privileged authenticated account, credential hygiene directly reduces exposure.
• Enforce strong, unique authentication for management access, including multi-factor authentication where the platform supports it, to make credential acquisition harder for the attacker.
• Monitor CLI access logs and process-creation telemetry for path traversal strings (see Detection Guidance) and alert on anomalies from low-privileged accounts.
• If the vendor or a partner offers a workaround or configuration hardening (for example, CLI access restrictions or command restrictions) in response to this CVE, apply it — but only after validating it against the vendor's own advisory. No specific workaround was provided in the available data.

2. Patch / upgrade steps:

• Contact HPE Aruba Networking support and monitor the official ClearPass Policy Manager security advisory channel for a fix. No patch version is identified in the tracked sources at this time.
• When a fixed release is published, test in a staging environment and upgrade promptly. Back up configuration before applying updates.
• Track the CVE entry at NVD and the vendor advisory for status changes (affected versions, fixed versions, workarounds).

3. Long-term hardening:

• Adopt network segmentation that limits management plane reachability and prevents lateral movement from compromised management hosts.
• Implement least privilege in a formal identity governance program: periodically recertify administrative and operator accounts.
• Harden the appliance baseline: disable unnecessary services, restrict SSH/console access by source, and centralize logging to an immutable SIEM.
• Run configuration and vulnerability posture management against NAC appliances and treat them as critical assets in risk scoring.
• Reduce standalone attack surface for identity/NAC management by isolating management traffic and leveraging jump/bastion hosts with session recording.

References

• NVD — CVE-2026-79800: https://nvd.nist.gov/vuln/detail/CVE-2026-79800
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• HPE Aruba Networking ClearPass Policy Manager — official product/security advisory portal (check for the vendor advisory corresponding to this CVE; no advisory URL was provided in the tracked data): https://www.arubanetworks.com/support-services/security-bulletins/
• CISA Known Exploited Vulnerabilities Catalog (verify current status — CVE-2026-79800 is NOT listed in the provided data): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No malware campaigns, threat actor activity, or exploit-in-the-wild evidence were identified in the provided intelligence for CVE-2026-79800. No affected version range, vendor fix, or workaround was published in the available data as of this report.