Is CVE-2026-45169 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45169 being exploited in the wild.

How severe is CVE-2026-45169?

Informational severity, published 12 June 2026.

Which products and versions are affected?

Idira Privileged Access Manager (PAM) Self-Hosted Vault Prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8.

Is there a fix for CVE-2026-45169?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45169 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45169?

Check whether you run CyberArk Privileged Access Manager Self-Hosted Vault. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45169: Idira PAM Self-Hosted Vault denial of service via improper input validation

CVE-2026-45169 · Severity: info · Published 2026-06-12

Idira Privileged Access Manager (PAM) is a security solution used by organizations to protect and manage sensitive administrative credentials. A vulnerability in the Self-Hosted Vault component could allow the service to be unexpectedly shut down when it processes malformed data. This would result in a denial-of-service, preventing authorized users from accessing the credentials needed to manage critical business systems.

Vendors: CyberArk.

Quick answers

Is CVE-2026-45169 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45169 being exploited in the wild.
How severe is CVE-2026-45169?: Informational severity, published 12 June 2026.
Which products and versions are affected?: Idira Privileged Access Manager (PAM) Self-Hosted Vault Prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8.
Is there a fix for CVE-2026-45169?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45169 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45169?: Check whether you run CyberArk Privileged Access Manager Self-Hosted Vault. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An input validation vulnerability exists in the Idira Privileged Access Manager (PAM) Self-Hosted Vault. Under specific configuration scenarios, the Vault component fails to properly validate unexpected input, which can lead to an unhandled exception or service crash. An attacker capable of sending specially crafted data to the Vault service could trigger this condition, resulting in a localized denial-of-service (DoS). The issue is resolved in versions 15.0.3, 14.6.5, 14.2.7, and 14.0.8.

Affected products

Idira Privileged Access Manager (PAM) Self-Hosted Vault Prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8

Timeline

2026-06-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.