CVE-2026-45169 Idira Privileged Access Manager (PAM) Self-Hosted Vault: Denial of Service due to Unexpected Input Processing
Attackers can cause a localized denial of service in Idira PAM Self-Hosted Vault by sending unexpected input under specific configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45169?
CVE-2026-45169 is a high-severity denial of service vulnerability in CyberArk Software, a Palo Alto Networks Company PAM SH Vault, published on 12 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific circumstances and configuration scenarios, processing unexpected input could potentially lead to an unexpected service termination, resulting in a localized denial of service (DoS). CyberArk Security Bulletin: CA26-17
Weakness: CWE-400
Which versions are affected by CVE-2026-45169?
It affects 1 product.
Products include Paloaltonetworks Idira Privileged Access Manager Vault.
How do I fix CVE-2026-45169?
No fix has been published for CVE-2026-45169 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-45169 being exploited?
There is no known exploitation of CVE-2026-45169 in the wild and no public exploit code.
Sources
Also known as GHSA-3xcp-963x-rf7x.