CyberArk Privilege Cloud Connector EUVD-2026-36371

Attacker must be on the same adjacent network segment as the Privilege Cloud Connector (CVSS AV:A) to perform man-in-the-middle interception of its TLS sessions, and the Connector must be running a version prior to 1.1.100504 deployed under the unspecified 'specific conditions and configuration scenarios' referenced by CyberArk in bulletin CA26-17 (CVSS AT:P confirms a non-default attack requirement). A legitimate operator or system action triggering an outbound TLS connection from the Connector is required (CVSS UI:P, passive user interaction). No authentication to the Connector itself is required (PR:N). Exploitation is limited by the need for adjacent-network positioning, the specific vulnerable configuration, and the timing dependency on operator-initiated traffic - purely remote internet-based exploitation is not in scope.

The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H) signals an adjacent-network attack requiring no privileges but with specific attack requirements (AT:P) and passive user interaction (UI:P), which materially limits opportunistic mass exploitation; an attacker must be positioned on a network path the Connector traverses and the vulnerable configuration must be present. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, and no EPSS score was provided in the input. Real-world risk is concentrated in environments where the Connector is exposed to untrusted segments or where attackers have already achieved a foothold suitable for man-in-the-middle positioning; given the asset's role (privileged credential brokering), even a low-probability MITM scenario warrants prioritized patching despite the absence of confirmed exploitation. The description's qualifier 'under specific conditions and configuration scenarios' is not enumerated in the public data - defenders should confirm exact triggering conditions with CyberArk before relying on configuration-based mitigation.

An attacker with a foothold on the same broadcast/adjacent network as the Connector (for example, a compromised jump host or a rogue device on the management VLAN) performs ARP/DHCP/DNS spoofing to redirect the Connector's outbound TLS sessions through an attacker-controlled proxy. Because certificate validation is not fully enforced under the vulnerable configuration, the Connector accepts the attacker's forged certificate and the attacker observes or modifies privileged credential and session traffic in transit. No public exploit was identified at time of analysis, and the passive user-interaction requirement (UI:P) suggests a legitimate operator action - such as initiating a privileged session - is needed to trigger the vulnerable code path.