Is CVE-2026-45173 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45173 being exploited in the wild.

How severe is CVE-2026-45173?

Informational severity, with a CVSS score of 8.4, published 11 June 2026.

Which products and versions are affected?

CyberArk Identity Browser Extension < 26.8.1.

Is there a fix for CVE-2026-45173?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45173 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-45173?

Check whether you run CyberArk Identity Browser Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45173: CyberArk Idira Identity Browser Extension origin validation flaw

Q: Is there a fix for CVE-2026-45173?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-45173 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-45173?

Check whether you run CyberArk Identity Browser Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45173 · Severity: info · CVSS 8.4 · Published 2026-06-11

The Idira Identity Browser Extension, used for managing corporate identities and credentials, contains a security flaw in how it verifies the source of web pages. If a user visits a malicious website while logged into the extension, an attacker could trick the extension into performing unauthorized actions or changing settings. This could lead to the exposure of sensitive session information or unauthorized access to corporate resources managed by the tool.

Vendors: CyberArk.

Quick answers

Is CVE-2026-45173 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45173 being exploited in the wild.
How severe is CVE-2026-45173?: Informational severity, with a CVSS score of 8.4, published 11 June 2026.
Which products and versions are affected?: CyberArk Identity Browser Extension < 26.8.1.
Is there a fix for CVE-2026-45173?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45173 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-45173?: Check whether you run CyberArk Identity Browser Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An origin validation error (CWE-346) exists in the internal web-page verification routines of the Idira Identity Browser Extension. The vulnerability is triggered when an authenticated user navigates to a specially crafted webpage, allowing a remote attacker to bypass origin checks. This can be used to execute unauthorized application commands or modify execution parameters within the context of the user's browser session. The flaw affects Chrome, Firefox, and Edge builds prior to version 26.8.1. Users are advised to update to version 26.8.1 or later to remediate the issue.

Affected products

CyberArk Idira Identity Browser Extension < 26.8.1

Timeline

2026-06-11: disclosed
2026-06-11: advisory

References

https://docs.cyberark.com/find-identity-administration-docs/latest/en/content/getstarted/identity-new-doc-location.htm

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.