Vendor
CyberArk vulnerabilities
14 advisories tracked, 0 exploited in the wild according to CISA, 1 published in 2026.
Data refreshed 12 Oct 2026
Patch now
Exploited in the last two years (CISA KEV), or a 10%+ chance of exploitation in the next 30 days (EPSS).
Nothing from CyberArk meets this bar right now: no CVE in CISA's exploited list, and none with a high exploitation score.
Products covered
Select a product to see only its advisories.
All tracked advisories
Newest first. Full analysis marks the CVEs we've written up in depth; the rest link to an automatic summary.
| Published | CVE | Product | Issue | Severity | EPSS | Exploited |
|---|---|---|---|---|---|---|
| CVE-2026-2914 | Privileged Access Manager | CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege… | HIGH 8.5 | 0.17% | – | |
| CVE-2025-49831 | Identity and Secrets Manager | Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to IAM Authenticator Bypass via Mis-configured Network Device | CRITICAL 9.1 | 1.2% | – | |
| CVE-2025-49830 | Identity and Secrets Manager | Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to path traversal and file disclosure | HIGH 7.1 | 0.57% | – | |
| CVE-2025-49829 | Identity and Secrets Manager | Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations | MEDIUM 6 | 0.42% | – | |
| CVE-2025-49828 | Identity and Secrets Manager | Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Execution | HIGH 8.6 | 2.1% | – | |
| CVE-2025-49827 | Identity and Secrets Manager | Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Bypass of IAM Authenticator | CRITICAL 9.1 | 1.4% | – | |
| CVE-2024-54840 | Privileged Access Manager | PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not pro… | MEDIUM 4.2 | 0.16% | – | |
| CVE-2024-42337 | Identity and Secrets Manager | Exposure of Sensitive Information to an Unauthorized Actor | MEDIUM 4.3 | 0.31% | – | |
| CVE-2024-42338 | Identity and Secrets Manager | Exposure of Sensitive Information to an Unauthorized Actor | MEDIUM 4.3 | 0.29% | – | |
| CVE-2024-42339 | Identity and Secrets Manager | Exposure of Sensitive Information to an Unauthorized Actor | MEDIUM 4.3 | 0.29% | – | |
| CVE-2024-42340 | Identity and Secrets Manager | Client-Side Enforcement of Server-Side Security | HIGH 8.3 | 0.32% | – | |
| CVE-2022-22700 | Identity and Secrets Manager | CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the resp… | – | 1.1% | – | |
| CVE-2021-37151 | Identity and Secrets Manager | CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the… | – | 0.85% | – | |
| CVE-2020-4062 | Identity and Secrets Manager | Improper Access Control in Conjur OSS Helm Chart | HIGH 8.7 | 1.4% | – |
Sources: CyberArk security advisories, CISA KEV and FIRST EPSS. Severity is the vendor's own rating.