The vulnerability CVE-2026-45175 affects Idira Endpoint Privilege Manager Agent versions prior to 26.5. It stems from improper certificate validation and access control within the agent's internal validation processes. This flaw allows a local attacker with low privileges to bypass built-in security controls and cryptographic checks. Under certain conditions, this bypass can enable the attacker to circumvent the agent's self-defense features and execute unauthorized actions. The CVSS 4.0 base score is 8.5, reflecting high impact with local attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow a local attacker to bypass security controls and cryptographic validations within the Idira Endpoint Privilege Manager Agent. This may lead to the circumvention of the agent's self-defense mechanisms and unauthorized execution of operations, potentially compromising the security posture of the affected system. The impact affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, organizations should monitor CyberArk's security bulletins for updates. Until a patch is available, restrict local access to trusted users only and consider additional host-based controls to limit potential exploitation.