CVE-2026-45170
Idira Vendor PAM - Self-Hosted Connector: Potential Security Bypass due to Incomplete TLS Certificate Validation
Severity
High 7.5
CVSS 4.0
Exploited
Not listed
EPSS
0.001
1.2th percentile
Discovered by
Vendor
Vendor-published field
Published
Jun 12, 2026
Assigned by palo_alto
Description
Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be fully enforced. CyberArk Security Bulletin: CA26-17
Weakness: CWE-295
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | CyberArk Privileged Access Manager | Identity / IAM / MFA | cna-assigner |
Vendor-reported products (1)
- CyberArk Software, a Palo Alto Networks Company · Vendor PAM
Credit
Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue