TI-2026-02507 Aliases CVE-2026-2914 GHSA-vfwc-g9gj-ppmx

Improper privilege management in CyberArk Software, a Palo Alto Networks Company Endpoint…

LOW 38CWE-269Published 2026-02-25 · Updated 2026-05-10

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00161 5th percentileScored 2026-11-07

Fix Fixed Endpoint Privilege Manager Agent (CyberArk Software, a Palo Alto Networks Company): 25.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
CyberArk Software, a Palo Alto Networks Company	Endpoint Privilege Manager Agent	25.10 to before 25.12	25.12	Patch available	CNA

Endpoint Privilege Manager Agent VendorCyberArk Software, a Palo Alto Networks Company Affected 25.10 to before 25.12 Fixed in 25.12 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cyberark:endpoint_privilege_manager::::::::	before 25.11.0	Vulnerable	CyberArk

cpe:2.3:a:cyberark:endpoint_privilege_manager:*:*:*:*:*:*:*:* Versions before 25.11.0 Vulnerable ·CyberArk

Remediation

Fix · CNA Endpoint Privilege Manager Agent (CyberArk Software, a Palo Alto Networks Company) Fixed in 25.12

Timeline

2026-10-02 Threatist record created from CVE-2026-2914
2026-10-03 Alias added: GHSA-vfwc-g9gj-ppmx

References

Advisory 1

https://www.cyberark.com/product-security/

Other 1

https://docs.cyberark.com/epm/latest/en/content/release%20notes/release-notes.htm

TI-2024-08782 Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure KEVCVSS 4.0CRITICAL 9.9
TI-2024-03172 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect KEVCVSS 3.1CRITICAL 10.0
TI-2020-01936 PAN-OS: Authentication Bypass in SAML Authentication KEVCVSS 3.1CRITICAL 10.0
TI-2017-11675 Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and… KEVCVSS 3.1CRITICAL 9.8
TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2

See all 386 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences