CVE-2021-40993: Arubanetworks Clearpass Policy Manager

High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days.

A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.

Affected products

• Arubanetworks Clearpass Policy Manager: from 6.8.0, before 6.8.9 (fixed in 6.8.9); from 6.9.0, before 6.9.7 (fixed in 6.9.7); from 6.10.0, before 6.10.2 (fixed in 6.10.2); version 6.8.9 only; version 6.9.7 only

Published 2021-10-15. Last modified 2026-06-17.