CVE-2026-45171CWE-22

Idira Privileged Session Manager (PSM): Potential Code Execution due to an Incomplete Input Validation

High · published June 11, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberArk Security Bulletin: CA26-17 and CA26-18

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/RE:M/U:Amber
EPSS
0.00724 · 53.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-11T21:55Z
EPSS history
Timeline
  • 11 JUN 21:55Z
    Idira Privileged Session Manager (PSM): Potential Code Execution due to an Incomplete Input Validation
    cvelistv5