CVE-2026-45172: CWE-78: Improper Neutralization of Special Elements used in an OS Command in CyberArk Software, a Palo Alto Networks Company PAM Self-Hosted, Privilege Cloud
CVE-2026-45172 is a high-severity vulnerability in CyberArk Software's Idira Privileged Session Manager for SSH (PSMP). It arises from incomplete input validation in certain versions, allowing an authenticated, low-privileged user to potentially execute arbitrary commands on the PSMP host. The affected versions include 14.0, 14.2, 14.6, and 15.0. No official patch or remediation guidance is currently provided.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-45172) involves improper neutralization of special elements used in OS commands (CWE-78) within CyberArk's PSMP component. Due to incomplete input validation, an authenticated user with low privileges can execute arbitrary commands on the host system, potentially leading to privilege escalation or unauthorized system control. The vulnerability affects specific versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, but exact fixed versions are not confirmed in the provided data. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.
Potential Impact
An authenticated user with low privileges can execute arbitrary OS commands on the PSMP host, which may lead to unauthorized actions, privilege escalation, or compromise of the host system. This impacts the confidentiality and integrity of the system managed by CyberArk PAM Self-Hosted and Privilege Cloud products.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory (CyberArk Security Bulletins CA26-17 and CA26-18) for current remediation guidance. No official fix or temporary workaround is provided in the available data. Until a patch is available, restrict access to the affected versions and monitor for suspicious activity involving PSMP hosts.
CVE-2026-45172: CWE-78: Improper Neutralization of Special Elements used in an OS Command in CyberArk Software, a Palo Alto Networks Company PAM Self-Hosted, Privilege Cloud
Description
CVE-2026-45172 is a high-severity vulnerability in CyberArk Software's Idira Privileged Session Manager for SSH (PSMP). It arises from incomplete input validation in certain versions, allowing an authenticated, low-privileged user to potentially execute arbitrary commands on the PSMP host. The affected versions include 14.0, 14.2, 14.6, and 15.0. No official patch or remediation guidance is currently provided.
CVSS v4.0
Score 8.7high
Affected software
pkg:github/cyberark/psmpRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-45172) involves improper neutralization of special elements used in OS commands (CWE-78) within CyberArk's PSMP component. Due to incomplete input validation, an authenticated user with low privileges can execute arbitrary commands on the host system, potentially leading to privilege escalation or unauthorized system control. The vulnerability affects specific versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, but exact fixed versions are not confirmed in the provided data. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.
Potential Impact
An authenticated user with low privileges can execute arbitrary OS commands on the PSMP host, which may lead to unauthorized actions, privilege escalation, or compromise of the host system. This impacts the confidentiality and integrity of the system managed by CyberArk PAM Self-Hosted and Privilege Cloud products.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory (CyberArk Security Bulletins CA26-17 and CA26-18) for current remediation guidance. No official fix or temporary workaround is provided in the available data. Until a patch is available, restrict access to the affected versions and monitor for suspicious activity involving PSMP hosts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- palo_alto
- Date Reserved
- 2026-05-08T23:00:57.503Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2b336c815e7002b838f064
Added to database: 6/11/2026, 10:15:08 PM
Last enriched: 6/11/2026, 10:30:06 PM
Last updated: 6/12/2026, 12:44:17 AM
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.