Idira Endpoint Privilege Manager CVE-2026-45175

Attacker must already have local, authenticated code execution on an endpoint running Idira Endpoint Privilege Manager Agent prior to version 26.5 on Windows, macOS, or Linux, and must be able to reach the agent's internal validation interface used by its self-defense and cryptographic checks. Exploitation is limited by the CVSS vector's PR:L (a non-anonymous local principal is required) and by the description's qualifier that bypass occurs only 'under specific circumstances', implying particular agent states or call paths rather than any arbitrary invocation; no user interaction is needed (UI:N), and scope is confined to the local host (SC/SI/SA:N) so the bypass does not directly cross to other systems.

The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H/VA:H and SC/SI/SA:N gives a score of 8.5, reflecting high impact on the vulnerable agent but constrained to local, authenticated attackers with no scope change to other systems. No EPSS score, SSVC decision, or KEV listing was supplied, and no public exploit identified at time of analysis, so this is not evidence of widespread opportunistic exploitation; the realistic risk is targeted abuse on endpoints where a low-privileged user or malware foothold seeks to neutralize EPM before escalating. The TLP:Amber marking and the fact that the bug undermines a security control itself elevate priority above a typical local-only flaw - particularly on hosts that rely on EPM as a compensating control for users who would otherwise be local admins.

A standard user with an interactive session on a workstation protected by EPM - or malware running under that user - invokes the agent's internal validation interface with forged credentials or signatures, causing the agent to accept the request as trusted and disable its own self-defense. With EPM neutralized, the attacker then runs tools or installs persistence that EPM policy would normally have blocked. No public exploit identified at time of analysis.