CyberArk vulnerabilities
We track 7 vulnerabilities in CyberArk products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on February 25, 2026.
Latest CyberArk vulnerabilities
- 7.8 High severity
Endpoint Privilege Manager Agent: Improper Privilege Management
CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs
- 7.8 High severity
Endpoint Privilege Manager: Improper Privilege Management
CyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve privilege escalation through policy elevation of an Administration task.
- 9.8 Critical severity
conjur: Improper Authentication
An attacker of Secrets Manager, Self-Hosted installations that route traffic from Secrets Manager to AWS through a misconfigured network device can reroute authentication requests to a malicious server under the attacker’s control. CyberArk believes there to b
- 8.8 High severity
conjur: Improper Neutralization of Special Elements Used in a Template Engine
Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.4.1 are vulnerable to remote code execution An auth
- 9.8 Critical severity
conjur: Reliance on Untrusted Inputs in a Security Decision
Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.22.0 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.5 and 13.6 are vulnerable to bypass of the IAM auth
- 9.3 Critical severity
Endpoint Privilege Manager: Allocation of Resources Without Limits or Throttling
Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use. This issue a
- 7.3 High severity
Endpoint Privilege Manager: Improper Neutralization of Input During Web Page Generation
An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a new role in the "name" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the required additio