CVE-2026-45170
Idira Vendor PAM - Self-Hosted Connector: Potential Security Bypass due to Incomplete TLS Certificate Validation
Severity
High 7.5
CVSS 4.0
Exploited
Not listed
EPSS
0.001
1.2th percentile
Discovered by
Vendor
Published by the vendor
Published
Jun 12, 2026
Assigned by palo_alto
Description
Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be fully enforced. CyberArk Security Bulletin: CA26-17
Weakness: CWE-295
Affected products
| Vendor | Product | Category | Matched by |
|---|
No product mapping yet — this CVE is pending taxonomy review.
Vendor-reported affected versions (1)
- CyberArk Software, a Palo Alto Networks Company · Vendor PAM
Credit
Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue