Which versions of CyberArk PAM Self-Hosted Vault are affected by CVE-2026-45169?

CyberArk Privileged Access Manager Vault is vulnerable to an unauthenticated remote denial-of-service attack (no public exploit identified at time of analysis) affecting versions prior to 15.0.3,…. A patch is available.

How to fix or mitigate CVE-2026-45169?

24 hours: Verify deployed CyberArk PAM Vault version and identify affected systems running versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8. Implement network segmentation to restrict Vault access to authorized administrative networks. 7 days: Contact CyberArk/Palo Alto Networks support for available workarounds and hardening guidance per Security Bulletin CA26-17. Deploy IPS/WAF rules to filter malformed input to the Vault service and restrict API access through firewall rules. 30 days: Monitor for CyberArk patch releases. Plan and execute upgrade to patched versions 15.0.3, 14.6.5, 14.2.7, or 14.0.8 (depending on current baseline).

CyberArk PAM Self-Hosted Vault CVE-2026-45169

Q: What is the CVSS score of CVE-2026-45169?

CVE-2026-45169 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-36385 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-12 palo_alto

GHSA-3xcp-963x-rf7x

Denial Of Service Hashicorp Pam Sh Vault Cyberark Software A Palo Alto Networks Company

8.7

CVSS 4.0 · Vendor: palo_alto

Severity by source

Vendor (palo_alto) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

vuln.today AI

5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but description requires 'specific circumstances and configuration scenarios' so AC:H; availability-only impact (A:H, C/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (palo_alto).

CVSS VectorVendor: palo_alto

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 06:00 EUVD

Analysis Generated

Jun 12, 2026 - 05:29 vuln.today

CVE Published

Jun 12, 2026 - 04:32 cve.org

HIGH 8.7

DescriptionCVE.org

Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific circumstances and configuration scenarios, processing unexpected input could potentially lead to an unexpected service termination, resulting in a localized denial of service (DoS). CyberArk Security Bulletin: CA26-17

AnalysisAI

Denial of service in CyberArk Privileged Access Manager (PAM) Self-Hosted Vault allows remote attackers to terminate the Vault service by sending unexpected input under specific configuration scenarios, affecting versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8. Disclosed by Palo Alto Networks (which now owns CyberArk) via Security Bulletin CA26-17 with no public exploit identified at time of analysis, the CVSS 4.0 base score of 8.7 reflects the network-reachable, unauthenticated attack path against a security-critical service. The flaw is a CWE-400 resource/input handling issue that produces a localized DoS rather than code execution or data exposure.

Technical ContextAI

The affected component is the Vault tier of CyberArk PAM Self-Hosted, the central credential store underpinning privileged session management, secrets brokering, and just-in-time access for enterprise privileged accounts (CPE cpe:2.3:a:cyberark_software,_a_palo_alto_networks_company:pam_sh_vault). The Vault listens on proprietary protocols and exposes input parsing surfaces that, per the description, mishandle unexpected input. The root cause class is CWE-400 (Uncontrolled Resource Consumption); in practice this manifests as a validation gap where malformed or unexpected input is propagated into a code path that crashes or terminates the Vault process rather than being rejected at the boundary. The 'Hashicorp' tag in the intelligence feed hints that the issue may live in a Hashicorp-derived dependency (e.g., a vendored Go library or Vault-adjacent component) embedded into the CyberArk product, though this is not confirmed in the advisory text.

RemediationAI

Vendor-released patch: upgrade to CyberArk PAM Self-Hosted Vault 15.0.3, 14.6.5, 14.2.7, or 14.0.8 depending on your maintenance branch, per the release notes linked from Security Bulletin CA26-17 (docs.cyberark.com/pam-self-hosted/.../rn-whatsnew15-0-vault.htm#15.0.3 and the corresponding 14.6.5, 14.2.7, 14.0.8 pages). Until patching, restrict network reachability to the Vault by tightening firewall rules so only authorized CPM/PVWA/PSM/AAM components can reach the Vault listener (default TCP/1858) - note this is already a CyberArk-recommended hardening and should not break a correctly segmented deployment, though shared/flat networks will need ACL work. Confirm with CyberArk support which 'specific circumstances and configuration scenarios' trigger the bug so you can disable or reconfigure the offending feature as an interim control, and ensure Vault high-availability/DR replication is healthy so a forced restart of the primary does not extend the outage window.