CVE-2026-45172
HIGH WAF: High
CVSS 8.8
Published: 2026-06-11
CWE-78
Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18
WAF Coverage Analysis
OS Command Injection
High WAF Coverage
OWASP: A03:2021 Injection
932xxx - Remote Code Execution
Affected Software
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | idira_privileged_session_manager_for_ssh | 14.0 - 14.0.6 |
| paloaltonetworks | idira_privileged_session_manager_for_ssh | 14.2 - 14.2.5 |
| paloaltonetworks | idira_privileged_session_manager_for_ssh | 14.6 - 14.6.3 |
| paloaltonetworks | idira_privileged_session_manager_for_ssh | 15.0 - 15.0.2 |
References
- docs.cyberark.com (Release Notes)
- docs.cyberark.com (Release Notes)
- docs.cyberark.com (Release Notes)
- docs.cyberark.com (Release Notes)