Idira Endpoint Privilege Manager Agent versions prior to 26.5, specifically version 26.0, contain an improper privilege management vulnerability (CWE-269). This flaw allows a local attacker with low privileges to exploit internal communication mechanisms or file operations within high-privileged agent components to bypass permission restrictions. The vulnerability could lead to unauthorized local actions executed with elevated privileges. The CVSS 4.0 base score is 8.9, indicating high severity. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

A local attacker with low privileges could exploit this vulnerability to bypass permission restrictions and perform unauthorized actions with elevated privileges on the affected system. This could compromise system integrity and security by allowing unauthorized local privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, organizations should monitor CyberArk's security bulletins for updates. Until a fix is available, restrict local access to trusted users only and apply the principle of least privilege to limit potential exploitation.