This vulnerability (CVE-2026-45171) involves a path traversal issue (CWE-22) in CyberArk Privileged Session Manager and Vault. Due to incomplete input validation and misconfigured folder permissions, an authenticated user with low privileges can exploit this flaw to execute arbitrary code. The affected versions explicitly include 14.0, 14.2, 14.6, and 15.0. The CVSS 4.0 vector indicates local attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has published security bulletins CA26-17 and CA26-18 but has not yet provided an official fix or remediation level. The vulnerability is currently not known to be exploited in the wild.

An authenticated low-privileged user could leverage this path traversal vulnerability to execute arbitrary code on affected CyberArk Privileged Session Manager and Vault installations. This could lead to full compromise of the affected system's confidentiality, integrity, and availability. Given the critical CVSS score of 9.3, the impact is severe, potentially allowing attackers to escalate privileges and control sensitive privileged session management functions.

Patch status is not yet confirmed — check the vendor advisory (CyberArk Security Bulletins CA26-17 and CA26-18) for current remediation guidance. Until an official fix is released, restrict access to the affected systems to trusted users only and monitor for unusual activity. Follow CyberArk's official recommendations once available.