Skip to content
Noroxi

CyberArk records

30 published records for vendor cyberark.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

30 records
  • CVE-2019-7442
    51Plan

    An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remot

    CriticalCVSS 9.8Proof of conceptEPSS 40%

    cyberark · enterprise password vaultMay 8, 2019

  • CVE-2018-9843
    44Plan

    The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    cyberark · password vaultApr 12, 2018

  • CVE-2018-13052
    39Monitor

    In CyberArk Endpoint Privilege Manager (formerly Viewfinity), Privilege Escalation is possible if the attacker has one process that executes

    CriticalCVSS 9.8No exploitEPSS 1%

    cyberark · endpoint privilege managerJul 5, 2018

  • CVE-2025-49827
    36Monitor

    Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Bypass of IAM Authenticator

    CriticalCVSS 9.1No exploitEPSS 1%

    cyberark · conjurJul 15, 2025

  • CVE-2020-4062
    36Monitor

    Improper Access Control in Conjur OSS Helm Chart

    CriticalCVSS 9.0No exploitEPSS 1%

    cyberark · conjur oss helm chartJun 22, 2020

  • CVE-2025-49831
    36Monitor

    Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to IAM Authenticator Bypass via Mis-configured Network Device

    CriticalCVSS 9.1No exploitEPSS 1%

    cyberark · conjurJul 15, 2025

  • CVE-2025-49828
    35Monitor

    Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Execution

    HighCVSS 8.6No exploitEPSS 2%

    cyberark · conjurJul 15, 2025

  • CVE-2026-2914
    34Monitor

    CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk el

    HighCVSS 8.5No exploitEPSS 0%

    cyberark · endpoint privilege managerFeb 24, 2026

  • CVE-2019-3800
    32Monitor

    CF CLI writes the client id and secret to config file

    HighCVSS 7.8No exploitEPSS 2%

    pivotal · cloud foundry command line interfaceAug 5, 2019

  • CVE-2018-14894
    32Monitor

    CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file) to bypass intended

    HighCVSS 7.8Proof of conceptEPSS 1%

    cyberark · endpoint privilege managerApr 9, 2019

  • CVE-2021-31796
    31Monitor

    An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure.

    HighCVSS 7.5Proof of conceptEPSS 1%

    cyberark · credential providerSep 1, 2021

  • CVE-2017-11197
    31Monitor

    In CyberArk Viewfinity 5.5.10.95 and 6.x before 6.1.1.220, a low privilege user can escalate to an administrative user via a bug within the

    HighCVSS 7.8Proof of conceptEPSS 0%

    cyberark · viewfinityMay 3, 2023

  • CVE-2021-44049
    31Monitor

    CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan

    HighCVSS 7.8No exploitEPSS 0%

    cyberark · endpoint privilege managerJan 15, 2022

  • CVE-2025-66374
    31Monitor

    CyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve privilege escalation through policy elevation of an

    HighCVSS 7.8No exploitEPSS 0%

    cyberark · endpoint privilege managerFeb 3, 2026

  • CVE-2025-49830
    28Monitor

    Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to path traversal and file disclosure

    HighCVSS 7.1No exploitEPSS 0%

    cyberark · conjurJul 15, 2025

  • CVE-2019-9627
    28Monitor

    A buffer overflow in the kernel driver CybKernelTracker.sys in CyberArk Endpoint Privilege Manager versions prior to 10.7 allows an attacker

    HighCVSS 7.0No exploitEPSS 0%

    cyberark · endpoint privilege managerMar 8, 2019

  • CVE-2018-9842
    26Monitor

    CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replaying a logon message.

    MediumCVSS 5.3Proof of conceptEPSS 15%

    cyberark · password vaultApr 12, 2018

  • CVE-2024-42337
    26Monitor

    CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

    MediumCVSS 6.5No exploitEPSS 0%

    cyberark · identityAug 25, 2024

  • CVE-2025-49829
    24Monitor

    Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations

    MediumCVSS 6.0No exploitEPSS 0%

    cyberark · conjurJul 15, 2025

  • CVE-2024-54840
    24Monitor

    PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues

    MediumCVSS 6.1No exploitEPSS 0%

    cyberark · privileged access managerFeb 3, 2025

  • CVE-2020-25738
    22Monitor

    CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism by injecting a DLL i

    MediumCVSS 5.5No exploitEPSS 0%

    cyberark · endpoint privilege managerNov 27, 2020

  • CVE-2022-22700
    21Monitor

    CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'.

    MediumCVSS 5.3No exploitEPSS 1%

    cyberark · identityMar 3, 2022

  • CVE-2021-37151
    21Monitor

    CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid.

    MediumCVSS 5.3No exploitEPSS 0%

    cyberark · identitySep 1, 2021

  • CVE-2018-12903
    21Monitor

    In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603, there is persistent XSS via an account name on the create token scr

    MediumCVSS 5.4No exploitEPSS 0%

    cyberark · endpoint privilege managerJun 26, 2018

  • CVE-2021-31797
    20Monitor

    The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading

    MediumCVSS 5.1No exploitEPSS 0%

    cyberark · credential providerSep 1, 2021