CVE-2023-25589: Arubanetworks Clearpass Policy Manager

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to create arbitrary users on the platform. A successful exploit allows an attacker to achieve total cluster compromise.

Affected products

• Arubanetworks Clearpass Policy Manager: from 6.9.0, up to and including 6.9.13; from 6.10.0, up to and including 6.10.8; version 6.11.0 only; version 6.11.1 only

Published 2023-03-22. Last modified 2026-06-17.