CVE-2026-45171: Idira Privileged Session Manager (PSM): Potential Code Execution due to an Incomplete Input Validation

Synopsis

An incomplete input validation vulnerability combined with improperly configured folder permissions affects Idira Privileged Session Manager (PSM) versions prior to 14.0.5, 14.2.5, 14.6.3, and 15.0.3. The flaw is reachable over the network and requires only a low-privileged authenticated account, meaning any user with a basic login can attempt exploitation without needing administrative rights. Successful exploitation gives the attacker arbitrary code execution on the PSM host. Patched-image rebuilds at versions 14.0.5, 14.2.5, 14.6.3, and 15.0.3 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the PSM service over the network; there is no requirement for local or physical access to the host.

• AuthenticationRequired

  A valid low-privilege account is sufficient; no administrative or elevated credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker interacts directly with the PSM service.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or environmental prerequisites required to succeed.

Blast Radius

• Executes arbitrary code on the PSM host under the permissions of the running service process.
• Reads credentials, session recordings, and privileged account data managed by the PSM vault.
• Modifies or deletes session logs and audit trails, undermining forensic integrity.
• Disrupts availability of the PSM service, blocking privileged access workflows across connected systems.