PatchSiren cyber security CVE debrief

CVE-2026-45172 CyberArk Software, a Palo Alto Networks Company CVE debrief

CVE-2026-45172 is a HIGH-severity vulnerability in Idira Privileged Session Manager for SSH (PSMP). An authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host due to incomplete input validation. Affected versions include those prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6.

Vendor: CyberArk Software, a Palo Alto Networks Company
Product: PAM Self-Hosted, Privilege Cloud
CVSS: HIGH 8.7
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-11
Original CVE updated: 2026-06-23
Advisory published: 2026-06-11
Advisory updated: 2026-06-23

Who should care

Administrators and users of Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6 should apply patches to prevent potential arbitrary command execution.

Technical summary

The vulnerability, with a CVSS score of 8.7, allows an authenticated, low-privileged user to potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins CA26-17 and CA26-18 provide additional information.

Defensive priority

HIGH

Recommended defensive actions

Apply patches for Idira Privileged Session Manager for SSH (PSMP) versions 15.0.2, 14.6.3, 14.2.5, or 14.0.6 and later.
Review and implement secure input validation practices.

Evidence notes

CVE-2026-45172 was published on 2026-06-11T22:16:57.320Z and modified on 2026-06-12T15:30:26.567Z. The vendor is identified as Cyberark with low confidence.

Sources and references

Verified primary and authoritative sources

CVE-2026-45172 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-45172

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-45172 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45172

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-0-6.htm

[email protected]
Source reference
Unverified legacy reference

URL: https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-2-5.htm

[email protected]
Source reference
Unverified legacy reference

URL: https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-6-psmp.htm

[email protected]
Source reference
Unverified legacy reference

URL: https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew15-0-psmp.htm

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.