CVE-2026-45171 HIGH

CVE-2026-45171: Idira Privileged Session Manager (PSM): Potential Code Execution due to an Incomplete Input Validation

Vendor Cyberark Software, A Palo Alto Networks Company
Product Privileged Session Manager, Vault
Weakness CWE-22 · Path traversal
Published June 11, 2026
Last update June 13, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/RE:M/U:Amber

What the vulnerability does

01Description

Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberArk Security Bulletin: CA26-17 and CA26-18

Key dates

02Disclosure timeline

June 11, 2026 CVE published
June 13, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-58320 DIALink - Directory Traversal Authentication Bypass Vulnerability CVE-2022-44749 Opening workflows from untrusted resources may override arbitrary file system contents CVE-2025-26753 WordPress VideoWhisper Live Streaming Integration plugin <= 6.2 - Arbitrary File Download vulnerability CVE-2024-38358 Symlink bypasses filesystem sandbox in wasmer CVE-2021-24692 Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal