CVE-2026-45169: Idira PAM Self-Hosted Vault DoS Flaw

CVE-2026-45169 Overview

CVE-2026-45169 affects Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8. The vulnerability is an input validation flaw classified under [CWE-400] (Uncontrolled Resource Consumption). Under specific configuration scenarios, processing unexpected input can trigger unexpected service termination. The result is a localized denial of service (DoS) against the Vault component. The issue is tracked by CyberArk Security Bulletin CA26-17 and is exploitable over the network without authentication or user interaction.

Critical Impact
A network-reachable, unauthenticated attacker can terminate the Vault service, disrupting privileged credential brokering and session management for all downstream PAM consumers.

Affected Products

Idira PAM Self-Hosted Vault versions prior to 15.0.3
Idira PAM Self-Hosted Vault versions prior to 14.6.5 and 14.2.7
Idira PAM Self-Hosted Vault versions prior to 14.0.8

Discovery Timeline

2026-06-12 - CVE-2026-45169 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-45169

Vulnerability Analysis

The Vault component fails to validate specific input conditions before processing. When a crafted request reaches the service under vulnerable configuration scenarios, the parsing logic produces an unhandled error state. The process exits, terminating the Vault service and any in-flight privileged credential operations. CyberArk classifies the issue under the Denial of Service category in advisory CA26-17.

Because the Vault sits at the center of the PAM architecture, a service termination event cascades to dependent components. Password retrieval, session brokering, and credential rotation halt until the service is restarted. Operators must rely on monitoring and automatic restart policies to recover availability.

Root Cause

The root cause is improper input validation paired with uncontrolled resource consumption [CWE-400]. The Vault accepts malformed or unexpected input on a network-reachable interface and does not constrain the resulting processing path. Specific configuration combinations expand the exploitable surface beyond defaults.

Attack Vector

The attack vector is network-based with low complexity. An unauthenticated remote attacker who can reach the Vault service sends specially shaped input to trigger the termination. No privileges or user interaction are required. The impact is constrained to availability — confidentiality and integrity of stored secrets are not directly affected by this flaw.

No public proof-of-concept code or exploit module has been published. The EPSS probability is 0.301% as of 2026-06-18, indicating low near-term exploitation likelihood in the broader population.

Detection Methods for CVE-2026-45169

Indicators of Compromise

Unexpected Vault service termination or crash events recorded in CyberArk Vault application logs (PADR.log, ITAlog.log).
Repeated TCP connection attempts to Vault listener ports (default 1858) from a single source followed by service unavailability.
Failed credential retrieval errors reported by CPM, PVWA, or PSM components immediately after anomalous inbound traffic.

Detection Strategies

Alert on Vault.exe or related Vault service process exits that are not preceded by an administrative stop command.
Correlate Windows Service Control Manager Event ID 7034 (service terminated unexpectedly) with inbound network connections to the Vault listener.
Monitor for short-interval restart loops of the Vault service and flag any restart that follows external traffic from an untrusted segment.

Monitoring Recommendations

Forward Vault application and Windows system logs to a centralized SIEM for crash correlation across the PAM environment.
Track availability metrics for the Vault listener and trigger paging alerts on consecutive port probe failures.
Baseline normal inbound traffic patterns to the Vault and alert on protocol anomalies or malformed packet bursts.

How to Mitigate CVE-2026-45169

Immediate Actions Required

Upgrade to a fixed Vault build: 15.0.3, 14.6.5, 14.2.7, or 14.0.8 depending on the deployed branch.
Restrict network reachability of the Vault listener to known PAM component IP addresses using host-based and perimeter firewalls.
Review Vault configuration against CyberArk hardening guidance to remove any non-default settings that expand the attack surface.
Confirm Vault high-availability or DR replication is functional so a service termination does not extend the outage window.

Patch Information

CyberArk has published fixed versions through the PAM Self-Hosted release notes. See CyberArk Release Notes 15.0 Vault, CyberArk Release Notes 14.6 Vault, CyberArk Release Notes 14.2.7, and CyberArk Release Notes 14.0.8. Apply the patch corresponding to your maintenance branch and validate Vault startup against a backup before promoting to production.

Workarounds

Place the Vault behind a network segment that is only reachable by authorized PAM components and administrative jump hosts.
Configure the Windows Service Control Manager to automatically restart the Vault service on failure with a short recovery delay.
Disable any optional Vault configuration features called out in CA26-17 that increase exposure until the patch is deployed.

bash

# Restrict Vault listener to authorized PAM component subnets (Windows example)
netsh advfirewall firewall add rule name="CyberArk Vault 1858 - PAM components only" ^
  dir=in action=allow protocol=TCP localport=1858 ^
  remoteip=10.10.20.0/24,10.10.21.0/24 profile=any

# Configure automatic service recovery
sc.exe failure "CyberArk Logic Container" reset= 86400 actions= restart/60000/restart/60000/restart/60000