CVE-2026-45172
Idira Privileged Session Manager for SSH (PSMP): Arbitrary Command Execution via Improper Neutralization of Special Elements used in an OS Command
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18
| CWE | CWE-78 |
| Vendor | cyberark software, a palo alto networks company |
| Product | pam self-hosted, privilege cloud |
| Published | Jun 11, 2026 |
| Last Updated | Jun 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for cyberark software, a palo alto networks company pam self-hosted, privilege cloud
Be the first to know when new unknown vulnerabilities affecting cyberark software, a palo alto networks company pam self-hosted, privilege cloud are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
CyberArk Software, a Palo Alto Networks Company / PAM Self-Hosted, Privilege Cloud
14.0 < 14.0.6 14.2 < 14.2.5 14.6 < 14.6.3 15.0 < 15.0.2
References
docs.cyberark.com: https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew15-0-psmp.htm#15.0.2 docs.cyberark.com: https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-6-psmp.htm#14.6.3 docs.cyberark.com: https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-2-5.htm docs.cyberark.com: https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-0-6.htm
Credits
Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue