CyberArk PAM SH Vault up to 14.0.7/14.2.6/14.6.4/15.0.2 Configuration resource consumption

Summaryinfo

A vulnerability has been found in CyberArk PAM SH Vault up to 14.0.7/14.2.6/14.6.4/15.0.2 and classified as problematic. This impacts an unknown function of the component Configuration Handler. This manipulation causes resource consumption. This vulnerability is registered as CVE-2026-45169. The attack needs to be launched locally. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in CyberArk PAM SH Vault up to 14.0.7/14.2.6/14.6.4/15.0.2. It has been declared as problematic. Affected by this vulnerability is an unknown part of the component Configuration Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific circumstances and configuration scenarios, processing unexpected input could potentially lead to an unexpected service termination, resulting in a localized denial of service (DoS). CyberArk Security Bulletin: CA26-17

The weakness was published with Palo Alto. It is possible to read the advisory at docs.cyberark.com. This vulnerability is known as CVE-2026-45169 since 05/09/2026. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 14.0.8, 14.2.7, 14.6.5 or 15.0.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-36385). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• CyberArk

Name

• PAM SH Vault

Version

• 14.0.0
• 14.0.1
• 14.0.2
• 14.0.3
• 14.0.4
• 14.0.5
• 14.0.6
• 14.0.7
• 14.2.0
• 14.2.1
• 14.2.2
• 14.2.3
• 14.2.4
• 14.2.5
• 14.2.6
• 14.6.0
• 14.6.1
• 14.6.2
• 14.6.3
• 14.6.4
• 15.0.0
• 15.0.1
• 15.0.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion