CVE-2026-2914

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2914", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2026-02-20T20:28:42.940Z", "datePublished": "2026-02-25T01:33:05.657Z", "dateUpdated": "2026-05-10T13:28:59.114Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Endpoint Privilege Manager Agent", "vendor": "CyberArk Software, a Palo Alto Networks Company", "versions": [{"lessThan": "25.12", "status": "affected", "version": "25.10", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "CyberArk Software, a Palo Alto Networks Company thanks Christophe Rieunier - CERT La Poste for discovering this issue."}], "datePublic": "2026-02-25T01:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs"}], "value": "CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Escalation of Privileges"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.5, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Insecure Permissions", "lang": "en"}]}], "providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-02-25T01:33:05.657Z"}, "references": [{"url": "https://www.cyberark.com/product-security/"}, {"url": "https://docs.cyberark.com/epm/latest/en/content/release%20notes/release-notes.htm"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T04:56:07.580063Z", "id": "CVE-2026-2914", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-10T13:28:59.114Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2914", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T04:56:07.580063Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:12:14.288Z"}}], "cna": {"source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "CyberArk Software, a Palo Alto Networks Company thanks Christophe Rieunier - CERT La Poste for discovering this issue."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Escalation of Privileges"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CyberArk Software, a Palo Alto Networks Company", "product": "Endpoint Privilege Manager Agent", "versions": [{"status": "affected", "version": "25.10", "lessThan": "25.12", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-25T01:00:00.000Z", "references": [{"url": "https://www.cyberark.com/product-security/"}, {"url": "https://docs.cyberark.com/epm/latest/en/content/release%20notes/release-notes.htm"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs", "supportingMedia": [{"type": "text/html", "value": "CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Insecure Permissions"}]}], "providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-02-25T01:33:05.657Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2914", "state": "PUBLISHED", "dateUpdated": "2026-05-10T13:28:59.114Z", "dateReserved": "2026-02-20T20:28:42.940Z", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "datePublished": "2026-02-25T01:33:05.657Z", "assignerShortName": "palo_alto"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Endpoint Privilege Manager Agent", "vendor": "CyberArk Software, a Palo Alto Networks Company", "versions": [{"lessThan": "25.12", "status": "affected", "version": "25.10", "versionType": "custom"}]}], "source": "psirt@paloaltonetworks.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cyberark:endpoint_privilege_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "19888249-C409-45A2-B756-7325E7D9DE36", "versionEndExcluding": "25.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs"}, {"lang": "es", "value": "Las versiones 25.10.0 e inferiores del Agente de CyberArk Endpoint Privilege Manager permiten una potencial elevaci\u00f3n de privilegios no autorizada aprovechando los di\u00e1logos de elevaci\u00f3n de CyberArk"}], "id": "CVE-2026-2914", "lastModified": "2026-06-17T10:32:01.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2914", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T04:56:07.580063Z", "version": "2.0.3"}}]}, "published": "2026-02-25T02:16:23.130", "references": [{"source": "psirt@paloaltonetworks.com", "tags": ["Release Notes"], "url": "https://docs.cyberark.com/epm/latest/en/content/release%20notes/release-notes.htm"}, {"source": "psirt@paloaltonetworks.com", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://www.cyberark.com/product-security/"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-269"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[25.10,25.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Endpoint Privilege Manager Agent", "source": "cna", "vendor": "CyberArk Software, a Palo Alto Networks Company"}, "product": "endpoint_privilege_manager", "vendor": "cyberark"}], "analysis": {"en": {"generated_at": "2026-04-17T15:34:56.199505+00:00", "value": {"mitigation_remediation": ["Upgrade the Endpoint Privilege Manager Agent to a version newer than 25.10.0 to eliminate the elevation flaw.", "Restrict the use of elevation dialogs to only approved applications and enforce additional authentication such as MFA where possible.", "Review and enforce least\u2011privilege user policies on the systems running the Agent to ensure that potential privilege escalation has minimal impact."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Affected systems are deployments of CyberArk Endpoint Privilege Manager Agent version 25.10.0 and earlier. The issue exists in the Agent software distributed by CyberArk, a Palo Alto Networks company, and impacts any workstation or server running the vulnerable Agent component. No specific patch version is listed in the input, but the vulnerability applies to all releases up to and including 25.10.0.", "description_and_impact": "The vulnerability allows an attacker to potentially elevate privileges by exploiting the Endpoint Privilege Manager Agent\u2019s elevation dialogs. The flaw resides in how the Agent processes these dialogs, permitting an unauthorized user to obtain higher privileges than intended. The weakness is classified as unauthorized elevation of privilege, CWE\u2011269.", "risk_and_exploitability": "The CVSS score of 8.5 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not reported in CISA\u2019s KEV catalog. An attacker would likely need to trick a user into interacting with an elevation dialog or already have local access to abuse the flaw, as the input does not explicitly describe the attack vector. Organizations that mitigate the flaw should promptly apply the latest Agent release and review privilege elevation practices."}}}}, "created": "2026-02-25T11:35:14.982664+00:00", "title": "Privilege Elevation via Endpoint Privilege Manager Elevation Dialogs", "updated": "2026-04-17T15:45:15.891959+00:00", "vendors": ["cyberark", "cyberark$PRODUCT$endpoint_privilege_manager"]}