CVE-2026-45174 PUBLISHED

Idira Endpoint Privilege Manager Linux Agent: Potential bypass of Agent Daemon Initialization

Assigner: palo_alto
Reserved: 08.05.2026 Published: 11.06.2026 Updated: 12.06.2026

Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potentially compromise the agent daemon initialization. CyberArk Security Bulletin: CA26-19

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber
CVSS Score: 8.5

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	CyberArk Software, a Palo Alto Networks Company
Product	Idira Endpoint Privilege Manager
Versions	Default: unaffected affected from 26.0 to 26.5 (excl.)

Exploits

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Credits

Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue finder

References

https://docs.cyberark.com/epm/latest/en/content/release%20notes/rn-os-linux.htm#Version2650

Problem Types

CWE-404: Improper Resource Shutdown or Release CWE

Impacts

CAPEC-554 Functionality Bypass