CyberArk Software, a Palo Alto Networks Company vulnerabilities
We track 10 vulnerabilities in CyberArk Software, a Palo Alto Networks Company products across 8 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on June 12, 2026.
Latest CyberArk Software, a Palo Alto Networks Company vulnerabilities
- 8.6 High severity
PAM SH Vault: Uncontrolled Resource Consumption
Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific circumstances and configuration scenarios, processing unexpected input could potentially lead to an
- 8.8 High severity
Vendor PAM: Improper Certificate Validation
Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be fully enforced. CyberArk Security Bulletin: CA26-17
- 7.8 High severity
Idira Endpoint Privilege Manager: Improper Resource Shutdown or Release
Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potentially compromise the agent daemon initialization. CyberArk Security Bulletin: CA26-19
- 8.8 High severity
PAM Self-Hosted, Privilege Cloud: Improper Neutralization of Special Elements used in an OS Command
Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security B
- 8.8 High severity
Privileged Session Manager, Vault: Improper Limitation of a Pathname to a Restricted Directory
Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberAr
- 7.8 High severity
Idira Endpoint Privilege Manager: Improper Certificate Validation
Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent validation processes. A local attacker could potentially bypass built-in security controls or cryptographic validations. Under specific circumst
- 8.1 High severity
Conjur Enterprise: Improper Access Control
Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve un
- 9.1 Critical severity
Conjur Cloud (Edge Finding only): Improper Access Control
Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components. A remote, unauthenticated attacker could exploit this by submitting a specially crafted request. Under specific circumstances,
- 7.8 High severity
Idira Endpoint Privilege Manager: Improper Privilege Management
Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent components. A local, low-privileged attacker could exploit this by manipulating an internal communication mechanism or file operation. Un
- 7.8 High severity
Endpoint Privilege Manager Agent: Improper Privilege Management
CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs