CVE-2026-45172: Idira Privileged Session Manager for SSH (PSMP): Arbitrary Command Execution via Improper Neutralization of Special Elements used in an OS Command
Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Idira Privileged Session Manager for SSH (PSMP)to a version that resolves this vulnerability.Fixed in 15.0.2 - Upgrade
Upgrade
Idira Privileged Session Manager for SSH (PSMP)to a version that resolves this vulnerability.Fixed in 14.6.3 - Upgrade
Upgrade
Idira Privileged Session Manager for SSH (PSMP)to a version that resolves this vulnerability.Fixed in 14.2.5 - Upgrade
Upgrade
Idira Privileged Session Manager for SSH (PSMP)to a version that resolves this vulnerability.Fixed in 14.0.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45172?
CVE-2026-45172 has a high severity rating of 8.7.
How do I fix CVE-2026-45172?
To fix CVE-2026-45172, update Idira Privileged Session Manager for SSH to versions 15.0.2, 14.6.3, 14.2.5, or 14.0.6 or later.
What type of vulnerability is CVE-2026-45172?
CVE-2026-45172 is an OS command injection vulnerability caused by improper input validation.
Who is affected by CVE-2026-45172?
CVE-2026-45172 affects authenticated, low-privileged users of Idira Privileged Session Manager for SSH.
When was CVE-2026-45172 published?
CVE-2026-45172 was published on June 11, 2026.