Delinea Privilege Manager EUVD-2026-113417

The description gates exploitation on unspecified 'certain conditions' and the exact trigger is not described in the available sources. The underlying weakness is CWE-306 (Missing Authentication for Critical Function), and the 'Authentication Bypass' tag plus the prose indicate no authentication is required for the stated path. However, the vendor CVSS 4.0 vector contradicts this by requiring high privileges (PR:H), active user interaction (UI:A), elevated attack complexity (AC:H) and specific attack requirements (AT:P) - i.e. a non-default, condition-dependent, interaction-driven path rather than a drive-by unauthenticated one. These contradictory prerequisites are the primary limiting factors and should be clarified with Delinea; defenders cannot yet confirm from this data whether default deployments are exposed. Affected builds are Privilege Manager 10.1.0-12.0.5796 and 13.0.0-13.0.1058.

The input carries a vendor-supplied CVSS 4.0 vector scoring 8.7 (high), but there is a material internal conflict that dominates this assessment. The description states a 'remote unauthenticated attacker' achieving code execution as LocalSystem, and this is reinforced by CWE-306 (Missing Authentication for Critical Function) and the 'Authentication Bypass' tag - all pointing to no authentication required. Yet the supplied CVSS 4.0 vector contains PR:H (high privileges required), UI:A (active user interaction), AC:H (high attack complexity) and AT:P (attack requirements present), which collectively describe a privileged, interaction-dependent, condition-gated attack - not an unauthenticated one. These signals cannot both be true: either the prose understates the prerequisites or the vector overstates them. This must be verified with Delinea before treating the flaw as trivially unauthenticated. On the exploitation-maturity axis the picture is calmer: no EPSS probability is provided, there is no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or imminent exploitation. The vuln.today decision label is 'this_week', indicating prioritized but not emergency remediation. Net: a high-severity full-compromise (code execution as LocalSystem) in enterprise PAM software warranting prompt patching this cycle, but the headline 'remote unauthenticated RCE' framing is not internally consistent with the vendor's own vector and should not be reported as settled fact.

Under conditions not specified in the available sources, an attacker reaches the Delinea Privilege Manager agent over the network and abuses a missing-authentication weakness (CWE-306) to run arbitrary code with LocalSystem privileges, fully compromising the host. No public exploit identified at time of analysis. Note that the vendor CVSS vector implies the real path also requires high privileges and user interaction, which would substantially narrow this scenario.