CyberArk PAM Self-Hosted Vault EUVD-2026-36385

Exploitation requires network reachability to the CyberArk Vault listener (typically TCP/1858) and that the Vault is running an affected build (<15.0.3, <14.6.5, <14.2.7, or <14.0.8) in one of the unspecified 'specific circumstances and configuration scenarios' called out by CyberArk - the advisory does not name the exact feature/setting, so defenders should request the trigger details from CyberArk support. No authentication is required per the CVSS 4.0 vector (PR:N, UI:N), and no user interaction is needed. Limiting factors: the bug is a denial-of-service only (no credential disclosure or integrity loss), the configuration precondition means default/hardened deployments may not be exploitable, and properly segmented Vault networks (the CyberArk-recommended posture) further reduce reachability.

Signals diverge sharply and should be weighed carefully. CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N indicates a trivially reachable, unauthenticated network attack with no user interaction, and VA:H/SA:L pushes the score to 8.7 (High); the U:Amber tag suggests vendor-coordinated handling. However, the only impact is availability of the vulnerable system (VC:N/VI:N) with a 'localized' DoS - no confidentiality or integrity loss, and the description explicitly conditions exploitation on 'specific circumstances and configuration scenarios,' which is not reflected in the AC:L/AT:N metrics and likely overstates real-world ease. EPSS data was not provided, the CVE is not on CISA KEV, and no public exploit identified at time of analysis. Net read: this is a meaningful operational risk because the Vault is a single-point-of-failure for privileged access workflows and an outage cascades to every dependent system, but it is not a confidentiality/integrity emergency and the 'specific configuration' caveat means the realistic exploitable population is smaller than the score implies - verify applicability with CyberArk before treating as P0.

A remote attacker with network reach to the Vault listener crafts an unexpected input payload to the Vault protocol endpoint, which the affected version fails to validate, causing the Vault service process to terminate. Because the Vault brokers credentials for every PAM-managed account, the resulting outage immediately halts privileged session launches, password rotations, and CPM/PSM operations across the enterprise until the service is restarted. No public exploit identified at time of analysis, so weaponization would require reverse-engineering the CyberArk Vault protocol and the specific configuration trigger.