CVE-2026-45169CWE-400

Idira Privileged Access Manager (PAM) Self-Hosted Vault: Denial of Service due to Unexpected Input Processing

High · published June 12, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
49.6
In the wild
Unconfirmed
What it is

Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific circumstances and configuration scenarios, processing unexpected input could potentially lead to an unexpected service termination, resulting in a localized denial of service (DoS). CyberArk Security Bulletin: CA26-17

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/U:Amber
EPSS
0.00630 · 49.6th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-06-12T04:32Z
EPSS history
Timeline
  • 12 JUN 04:32Z
    Idira Privileged Access Manager (PAM) Self-Hosted Vault: Denial of Service due to Unexpected Input Processing
    cvelistv5