Read the docs
TI-2018-09365 Aliases CVE-2018-13052GHSA-vqq3-6hq7-qcxr

In CyberArk Endpoint Privilege Manager (formerly Viewfinity), Privilege Escalation is…

Priority MEDIUM 44Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

In CyberArk Endpoint Privilege Manager (formerly Viewfinity), Privilege Escalation is possible if the attacker has one process that executes as Admin.

Why it matters now

EPSS 0.01205 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cyberark:endpoint_privilege_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableCyberArk
  • cpe:2.3:a:cyberark:endpoint_privilege_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·CyberArk

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-13052
  2. 2026-10-03 Alias added: GHSA-vqq3-6hq7-qcxr

References

Advisory 1

  • TI-2026-02507 Improper privilege management in CyberArk Software, a Palo Alto Networks Company Endpoint… CVSS 4.0HIGH 8.5
  • TI-2018-10713 CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is… CVSS 3.0HIGH 7.8
  • TI-2025-40819 CyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve… CVSS 3.1HIGH 7.8
  • TI-2021-19798 CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a… CVSS 3.1HIGH 7.8
  • TI-2019-07042 A buffer overflow in the kernel driver CybKernelTracker.sys in CyberArk Endpoint… CVSS 3.1HIGH 7.0
  • TI-2020-15749 CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a… CVSS 3.1MEDIUM 5.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences