CVE-2026-45170

Idira Vendor PAM - Self-Hosted Connector: Potential Security Bypass due to Incomplete TLS Certificate Validation

Severity

High 7.5

CVSS 4.0

Adjacent, local or physical access what this means

Exploited

Not listed

EPSS

0.002

5.7th percentile

Discovered by

Vendor

Vendor-published field

Published

Jun 12, 2026

Assigned by palo_alto

Description

Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be fully enforced. CyberArk Security Bulletin: CA26-17

Weakness: CWE-295

Affected products

Vendor	Product	Category	Matched by
Palo Alto Networks	CyberArk Privileged Access Manager	Identity / IAM / MFA	cna-assigner

Vendor-reported products (1)

CyberArk Software, a Palo Alto Networks Company · Vendor PAM

Credit

Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue

References

https://docs.cyberark.com/

Something wrong here?