{"id":"CVE-2026-45169","title":"Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability","summary":"Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific circumstances and configuration scenarios, processing unexpected input could …","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cwe":["CWE-400"],"vendor":"paloaltonetworks","product":"idira_privileged_access_manager_vault","affected":["idira_privileged_access_manager_vault >= 14.0, < 14.0.8","idira_privileged_access_manager_vault >= 14.2, < 14.2.7","idira_privileged_access_manager_vault >= 14.6, < 14.6.5","idira_privileged_access_manager_vault >= 15.0, <= 15.0.3"],"patched":["idira_privileged_access_manager_vault 14.6.5"],"published":"2026-06-12","updated":"2026-07-07","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45169","references":[{"url":"https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-0-8.htm","label":"psirt@paloaltonetworks.com"},{"url":"https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-2-7.htm","label":"psirt@paloaltonetworks.com"},{"url":"https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-6-vault.htm#14.6.5","label":"psirt@paloaltonetworks.com"},{"url":"https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew15-0-vault.htm#15.0.3","label":"psirt@paloaltonetworks.com"}],"tags":["nvd"],"epss":0.0035,"epssPercentile":0.2875,"ingestedAt":"2026-07-07T15:38:35.740Z","slug":"CVE-2026-45169","body":"## Overview\n\nIdira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific circumstances and configuration scenarios, processing unexpected input could potentially lead to an unexpected service termination, resulting in a localized denial of service (DoS). CyberArk Security Bulletin: CA26-17\n\n## Affected\n\n- `idira_privileged_access_manager_vault >= 14.0, < 14.0.8`\n- `idira_privileged_access_manager_vault >= 14.2, < 14.2.7`\n- `idira_privileged_access_manager_vault >= 14.6, < 14.6.5`\n- `idira_privileged_access_manager_vault >= 15.0, <= 15.0.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `idira_privileged_access_manager_vault 14.6.5`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}