This vulnerability (CVE-2026-45170) concerns improper TLS certificate validation in CyberArk Software's Vendor PAM product, specifically the Idira Vendor PAM - Self-Hosted Connector versions before 1.1.100504. The flaw arises under specific conditions and configuration scenarios where TLS certificate validation is not fully enforced, potentially allowing attackers to circumvent TLS protections. The CVSS 4.0 vector indicates the attack requires adjacent network access, low attack complexity, no privileges required, and user interaction, with high impacts on confidentiality, integrity, and availability. No official remediation or patch has been documented in the provided data, and no known exploits have been observed in the wild.

The vulnerability can lead to improper TLS certificate validation, which may allow attackers to intercept or manipulate communications that are expected to be protected by TLS. This undermines the confidentiality, integrity, and availability of the affected system's communications. Given the high CVSS score (7.5) and the nature of the flaw, the impact is significant in environments where secure TLS connections are critical.

Patch status is not yet confirmed — check the vendor advisory (CyberArk Security Bulletin: CA26-17) for current remediation guidance. Until an official fix is available, carefully review and harden TLS configuration settings to ensure strict certificate validation is enforced. Monitor CyberArk's advisories for updates and apply patches promptly once released.