CVE-2026-45175: Idira Endpoint Privilege Manager Agent: Security Control and Cryptographic Validation Bypass in Internal Agent Validation Processes

Synopsis

An improper access control vulnerability affects the Idira Endpoint Privilege Manager Agent, a local privilege management component from CyberArk Software. A local attacker with a low-privilege account can bypass built-in security controls or cryptographic validations within the agent's internal validation processes, circumventing agent self-defense mechanisms and executing unauthorized operations with elevated access. A patched-image rebuild at version 26.5 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to reach the vulnerable component.

• AuthenticationRequired

  Any low-privilege local account is sufficient to attempt the bypass; no administrative credentials are needed.

• Victim interactionNot required

  No action from another user or victim is required to exploit this vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or environmental prerequisites identified in the CVSS vector.

Blast Radius

• Reads sensitive data accessible to the privilege manager agent, including credentials or policy configurations protected by the agent's cryptographic controls.
• Modifies agent policy state or persisted configuration, undermining privilege enforcement decisions made by the endpoint manager.
• Crashes or disrupts the privilege manager agent process, disabling endpoint privilege enforcement on the affected host.