CVE-2026-45171
Full vulnerability record from the local CVENow database.
Description
Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberArk Security Bulletin: CA26-17 and CA26-18
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-11 22:16:57.140000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-45171",
"sourceIdentifier": "[email protected]",
"published": "2026-06-11T22:16:57.140",
"lastModified": "2026-10-26T11:10:00.157",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberArk Security Bulletin: CA26-17 and CA26-18"
},
{
"lang": "es",
"value": "Validación de entrada incompleta y permisos de carpeta configurados incorrectamente dentro de las versiones de Idira Privileged Session Manager (PSM) anteriores a 15.0.3, 14.6.3, 14.2.5 y 14.0.5, un usuario autenticado y con privilegios bajos podría ejecutar código arbitrario. Boletín de seguridad de CyberArk: CA26-17 y CA26-18"
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "CyberArk Software, a Palo Alto Networks Company",
"product": "Privileged Session Manager, Vault",
"defaultStatus": "unaffected",
"versions": [
{
"version": "14.0",
"lessThan": "14.0.5",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "14.0.5",
"status": "unaffected"
}
]
},
{
"version": "14.2",
"lessThan": "14.2.5",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "14.2.5",
"status": "unaffected"
}
]
},
{
"version": "14.6",
"lessThan": "14.6.3",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "14.6.3",
"status": "unaffected"
}
]
},
{
"version": "15.0",
"lessThan": "15.0.3",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "15.0.3",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Amber",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "AMBER"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-12T00:00:00+00:00",
"id": "CVE-2026-45171",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:idira_privileged_session_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "14.0",
"versionEndExcluding": "14.0.5",
"matchCriteriaId": "EC340C24-8BA9-4FB6-82AA-F4A9BE932842"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:idira_privileged_session_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "14.2",
"versionEndExcluding": "14.2.5",
"matchCriteriaId": "B2F5966E-C9A9-4649-95B3-AA3673BC9453"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:idira_privileged_session_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "14.6",
"versionEndExcluding": "14.6.3",
"matchCriteriaId": "E037B3A2-1388-4CA3-B1AD-C9527538BED6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:idira_privileged_session_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.0",
"versionEndExcluding": "15.0.3",
"matchCriteriaId": "9745D2FD-B839-4F2A-A93F-9BB4A3119B5B"
}
]
}
]
}
],
"references": [
{
"url": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-0-5.htm",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-2-5.htm",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-6-psm.htm#14.6.3",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew15-0-psm.htm#15.0.3",
"source": "[email protected]",
"tags": [
"Release Notes"
]
}
]
}