CVE-2026-45172: Idira Privileged Session Manager for SSH (PSMP): Arbitrary Command Execution via Improper Neutralization of Special Elements used in an OS Command

Synopsis

An OS command injection vulnerability affects Idira Privileged Session Manager for SSH (PSMP) by CyberArk (a Palo Alto Networks company) in versions prior to 14.0.6, 14.2.5, 14.6.3, and 15.0.2. The flaw is reachable over the network by any authenticated low-privilege user, with no victim interaction required, due to incomplete input validation that fails to neutralize special characters before passing them to an OS-level command. Successful exploitation lets the attacker run arbitrary commands directly on the PSMP host. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the PSMP service over the network; the vulnerability is exposed via a network-accessible endpoint (AV:N).

• AuthenticationRequired

  Any valid low-privilege account is sufficient to trigger the vulnerability; no administrative rights are needed (PR:L).

• Victim interactionNot required

  No action from another user or administrator is needed to complete the attack (UI:N).

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors must align (AC:L, AT:N).

Blast Radius

• Reads sensitive data accessible to the PSMP process, including credentials, session metadata, and host configuration files (VC:H).
• Modifies files, processes, or system state on the PSMP host with the privileges of the compromised process (VI:H).
• Causes limited degradation of PSMP service availability; full denial of service is not indicated by impact scoring (VA:L).
• Impact is confined to the PSMP host itself; no lateral spread to systems outside the security scope is indicated (SC:N, SI:N, SA:N).