CyberArk PSM EUVD-2026-36365

Attacker must hold valid credentials for a low-privileged account on CyberArk PSM (PAM Self-Hosted) and be able to reach the PSM service over the network; the deployment must be running PSM on the 14.0.x, 14.2.x, 14.6.x, or 15.0.x branch below the respective fixed builds (14.0.5 / 14.2.5 / 14.6.3 / 15.0.3) with the default folder-permission layout that the advisory describes as improperly configured. No user interaction and no MFA/admin role is required (PR:L, UI:N, AT:N), but exploitation is bounded by network reachability of PSM and by whether the organisation has already hardened the affected working-directory ACLs as a defence-in-depth measure.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H reflects a network-reachable, low-complexity flaw exploitable by an authenticated low-privileged user with full CIA impact on the vulnerable system - and the U:Amber + RE:M tags from the vendor signal moderate response urgency on a partner-amber distribution. No EPSS, KEV, or SSVC data is provided, and no public exploit identified at time of analysis, so this is not yet evidence of widespread opportunistic exploitation. Real-world risk is still elevated because PSM sits at the heart of privileged access: any low-privileged user account on the PSM - including a compromised vendor or operator account - becomes a stepping stone to vaulted credentials, so prioritization should be driven by PSM's blast radius rather than by exploit-market signals.

An attacker phishes or otherwise obtains credentials of a low-privileged PSM user (for example a help-desk operator) and authenticates to the PSM web interface; they then submit a request whose path-like parameter contains traversal sequences that, combined with the overly-permissive folder ACLs, lets them drop or reference a payload in a directory the PSM service later executes from. With code running in the PSM service context they pivot to vaulted credentials and connected targets, effectively turning a low-privileged PAM account into full control of the privileged-access plane. No public exploit identified at time of analysis.