Read the docs
TI-2026-32997 Aliases CVE-2026-45176GHSA-5cgm-xvc8-25j7

Improper privilege management in CyberArk Software, a Palo Alto Networks Company Idira…

Priority LOW 39CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent components. A local, low-privileged attacker could exploit this by manipulating an internal communication mechanism or file operation. Under specific circumstances, this could potentially allow the attacker to bypass permission restrictions and execute unauthorized local actions with elevated privileges. CyberArk Security Bulletin: CA26-19

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00124 2nd percentileScored 2026-11-07
Fix Fixed Idira Endpoint Privilege Manager (CyberArk Software, a Palo Alto Networks Company): 26.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CyberArk Software, a Palo Alto Networks CompanyIdira Endpoint Privilege Manager26.0 to before 26.526.5Patch availableCNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:paloaltonetworks:idira_endpoint_privilege_manager:*:*:*:*:*:*:*:*before 26.5.0VulnerableCyberArk Software, a Palo Alto Networks Company
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:paloaltonetworks:idira_endpoint_privilege_manager:*:*:*:*:*:*:*:* Versions before 26.5.0 Vulnerable ·CyberArk Software, a Palo Alto Networks Company
  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA Idira Endpoint Privilege Manager (CyberArk Software, a Palo Alto Networks Company) Fixed in 26.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    CyberArk Software, a Palo Alto Networks Idira Endpoint Privilege Manager — docs.cyberark.com/epm/latest/en/content/release%20notes/rn-…

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-32996 Improper certificate validation in CyberArk Software, a Palo Alto Networks Company Idira…Priority LOW 38
    • TI-2026-32995 Idira Endpoint Privilege Manager Linux Agent: Potential bypass of Agent Daemon InitializationPriority LOW 38
    Show all 3 records → Advisory →
  • Advisory ·

    CyberArk Software, a Palo Alto Networks Idira Endpoint Privilege Manager — docs.cyberark.com/epm/latest/en/content/release%20notes/rn-…

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-32996 Improper certificate validation in CyberArk Software, a Palo Alto Networks Company Idira…Priority LOW 38
    Show all 2 records → Advisory →
Show 1 more group
  • Advisory ·

    CyberArk Software, a Palo Alto Networks Idira Endpoint Privilege Manager — docs.cyberark.com/epm/latest/en/content/release%20notes/rn-…

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-32996 Improper certificate validation in CyberArk Software, a Palo Alto Networks Company Idira…Priority LOW 38
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45176
  2. 2026-10-03 Alias added: GHSA-5cgm-xvc8-25j7
  3. 2026-10-25 Priority changed: MEDIUM → LOW

References

Advisory 3

  • TI-2026-32996 Improper certificate validation in CyberArk Software, a Palo Alto Networks Company Idira… CVSS 4.0HIGH 8.5
  • TI-2026-32995 Idira Endpoint Privilege Manager Linux Agent: Potential bypass of Agent Daemon Initialization CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences