CVE-2026-45170: Idira Privilege Cloud TLS Vulnerability

CVE-2026-45170 Overview

CVE-2026-45170 affects CyberArk Idira Privilege Cloud Connector versions prior to 1.1.100504. Under specific conditions and configuration scenarios, the connector fails to fully enforce TLS certificate validation. This weakness is classified under [CWE-295] Improper Certificate Validation. An attacker positioned on an adjacent network can intercept or manipulate connector traffic by presenting an invalid or untrusted certificate that the client accepts. CyberArk documented the issue in Security Bulletin CA26-17.

Critical Impact
Adjacent-network attackers can perform man-in-the-middle interception of privileged session traffic carried by the Idira Privilege Cloud Connector, exposing credentials and session data.

Affected Products

CyberArk Idira Privilege Cloud Connector versions prior to 1.1.100504
Deployments operating under the specific conditions described in CyberArk Security Bulletin CA26-17
Privileged session workflows that route through the affected connector component

Discovery Timeline

2026-06-12 - CVE-2026-45170 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-45170

Vulnerability Analysis

The vulnerability stems from incomplete TLS certificate validation logic within the Idira Privilege Cloud Connector. Under specific deployment configurations, the connector establishes TLS sessions without fully verifying the server certificate chain, hostname, or trust anchors.

Privilege Cloud Connectors broker authentication and session traffic between on-premises directories or systems and CyberArk's cloud service. A connector that accepts invalid certificates exposes that traffic to interception. The Common Weakness Enumeration entry [CWE-295] Improper Certificate Validation captures this class of defect.

The issue requires an attacker to be present on an adjacent network segment and depends on user or configuration interaction to trigger the vulnerable code path. The EPSS probability for active exploitation is currently 0.086%, and no public proof-of-concept exists at the time of writing.

Root Cause

The connector's TLS client code does not enforce complete certificate validation in every code path. Specific configurations bypass checks for the certificate chain of trust, certificate revocation, or hostname binding. CyberArk's fix in version 1.1.100504 restores full validation across these scenarios.

Attack Vector

An attacker with access to an adjacent network segment, such as a shared VLAN or wireless network used by the connector host, intercepts outbound TLS connections. The attacker presents a fraudulent certificate. The connector accepts the certificate and establishes the encrypted session with the attacker, who then relays traffic to the legitimate endpoint. Credentials, tokens, and session content traversing the link become readable and modifiable.

No verified exploitation code is publicly available. Technical specifics are described in the CyberArk advisory and product documentation, available through the CyberArk Documentation portal.

Detection Methods for CVE-2026-45170

Indicators of Compromise

Unexpected TLS sessions from connector hosts terminating at IP addresses outside CyberArk's published service ranges
Certificate fingerprints in connector logs that do not match CyberArk's issued certificates
ARP table anomalies or duplicate MAC entries on the network segment hosting the connector
Authentication failures or session resets coinciding with man-in-the-middle relay attempts

Detection Strategies

Inspect outbound TLS metadata from connector hosts and alert on unknown certificate issuers or Subject Alternative Names
Correlate connector authentication events with network flow data to identify traffic redirected through unauthorized hops
Compare installed connector version against 1.1.100504 across the estate and flag older builds

Monitoring Recommendations

Enable verbose TLS logging on connector hosts and forward to a centralized analytics platform
Baseline normal destination IPs and ASN paths for connector traffic and alert on deviations
Monitor privileged account activity for unusual source addresses following any suspected network anomaly

How to Mitigate CVE-2026-45170

Immediate Actions Required

Upgrade Idira Privilege Cloud Connector to version 1.1.100504 or later on all hosts
Review the configurations referenced in CyberArk Security Bulletin CA26-17 and confirm they no longer apply post-upgrade
Rotate any credentials and session secrets that traversed the connector before patching if adjacent-network compromise is suspected

Patch Information

CyberArk addressed the issue in Idira Privilege Cloud Connector version 1.1.100504. Refer to CyberArk Security Bulletin CA26-17 and the CyberArk Documentation portal for download instructions, supported upgrade paths, and configuration guidance.

Workarounds

Restrict the network segments where connector hosts operate to dedicated, monitored VLANs with no untrusted devices
Enforce strict egress filtering so connector hosts can reach only CyberArk service endpoints
Apply host-based firewall rules and 802.1X authentication to limit adjacent-network exposure until the patch is deployed

bash

# Verify the installed connector version on Windows hosts
Get-ItemProperty "HKLM:\SOFTWARE\CyberArk\*" | Select-Object DisplayName, DisplayVersion

# Confirm version meets or exceeds 1.1.100504 before returning the host to service