# CVE-2026-45170: Idira Privilege Cloud Connector improper TLS certificate validation

Source: https://junglewise.ai/threats/cve-2026-45170-idira-privilege-cloud-connector-improper-tls-certificate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-45170 · Severity: info · CVSS 7.5 · Published 2026-06-12

The Idira Privilege Cloud Connector, a tool used to securely connect local infrastructure to cloud-based identity management services, contains a security flaw where it may fail to properly verify digital certificates. This could allow an attacker on the same local network to intercept or modify sensitive data as it travels between the connector and the cloud service. If exploited, this could lead to the exposure of administrative credentials or a disruption of identity management operations.

Vendors: [CyberArk](https://junglewise.ai/threats/vendors/cyberark).

## Quick answers

**Is CVE-2026-45170 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45170 being exploited in the wild.

**How severe is CVE-2026-45170?** Informational severity, with a CVSS score of 7.5, published 12 June 2026.

**Which products and versions are affected?** CyberArk Privilege Cloud Connector versions prior to 1.1.100504.

**Is there a fix for CVE-2026-45170?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45170 attacked?** It is attacked from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-45170?** Check whether you run CyberArk Privilege Cloud Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as Improper Certificate Validation (CWE-295) exists in the Idira Privilege Cloud Connector. Under specific conditions and configuration scenarios, the application fails to fully enforce TLS certificate validation during encrypted communications. An attacker positioned on an adjacent network (such as a local area network) could exploit this weakness to perform a man-in-the-middle (MitM) attack. Successful exploitation requires some user interaction and specific deployment conditions, but could result in a total loss of confidentiality, integrity, and availability for the affected connection. The issue is addressed in version 1.1.100504.

## Affected products

- Idira (CyberArk) Privilege Cloud Connector versions prior to 1.1.100504

## Timeline

- 2026-06-12: disclosed: Initial NVD publication date

## References

- [https://docs.cyberark.com/](https://docs.cyberark.com/)