High · 7.5 CVE-2026-45170 EUVD-2026-36371GHSA-4pc6-w92r-32xw

Idira Vendor PAM - Self-Hosted Connector: Potential Security Bypass due to Incomplete TLS Certificate Validation

Published Jun 12, 2026 · Updated Jun 23, 2026 · Assigned by palo_alto

Vendor: CyberArk Software, a Palo Alto Networks Company Product: Vendor PAM

Description

Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be fully enforced. CyberArk Security Bulletin: CA26-17

Affected products

Vendor	Product	Affected	Fixed
CyberArk Software, a Palo Alto Networks Company	Vendor PAM	1.1.0 – < 1.1.100504	1.1.100504

References

https://docs.cyberark.com/ vendor-advisory