← All Advisories

CyberArk Privileged Session Manager Incomplete Input Validation and Misconfigured Folder Permissions Allow an Authenticated Low-Privilege User to Execute Arbitrary Code

Last refreshed2026-09-30

Status: UPDATED  |  Advisory ID: CVE-2026-45171

Key Details

CVECVE-2026-45171
CVSS Score / Version8.8 (High) / CVSS v3.1
Updated2026-06-23
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Proseattack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected productsPalo Alto Networks idira_privileged_session_manager
Classified asCWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
Palo Alto Networksidira_privileged_session_manager
SubsystemsGeneral OT
SectorsMultiple

What to Know

Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberArk Security Bulletin: CA26-17 and CA26-18

What to Do

Monitor Palo Alto Networks's web page for any future patch releases.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-45171
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-45171