Status: UPDATED
| Advisory ID: CVE-2026-45176
Key Details
| CVE | CVE-2026-45176 |
| CVSS Score / Version | 7.8 (High) / CVSS v3.1 |
| Updated | 2026-06-22 |
| CVSS Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CVSS Prose | attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high. |
| Affected products | Palo Alto Networks idira_endpoint_privilege_manager |
| Classified as | CWE-269 (Improper Privilege Management) |
Affected Products, Subsystems & Sectors
| Subsystems | General OT |
| Sectors | Multiple |
What to Know
Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent components. A local, low-privileged attacker could exploit this by manipulating an internal communication mechanism or file operation. Under specific circumstances, this could potentially allow the attacker to bypass permission restrictions and execute unauthorized local actions with elevated privileges. CyberArk Security Bulletin: CA26-19 (NVD)
What to Do
Monitor Palo Alto Networks's web page for any future patch releases.
References