CVE-2026-45172

Summary

Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18

Affected Software

VendorProductVersion RangeStatus
CyberArk Software, a Palo Alto Networks CompanyPAM Self-Hosted, Privilege Cloud14.0 < 14.0.6affected
CyberArk Software, a Palo Alto Networks CompanyPAM Self-Hosted, Privilege Cloud14.2 < 14.2.5affected
CyberArk Software, a Palo Alto Networks CompanyPAM Self-Hosted, Privilege Cloud14.6 < 14.6.3affected
CyberArk Software, a Palo Alto Networks CompanyPAM Self-Hosted, Privilege Cloud15.0 < 15.0.2affected

Weaknesses

  • CWE-78: CWE-78: Improper Neutralization of Special Elements used in an OS Command

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References