GCVE - cpe:2.3:a:cyberark:endpoint_privilege

Approved changes feed: RSS · Atom

cpe:2.3:a:cyberark:endpoint_privilege_manager:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Cyberark (`9c54839f-9986-5c3d-9a93-34ddd2d9eb95`)
Product	Endpoint Privilege Manager (`6cd7c7c8-3410-52a4-a976-a4fcde12b712`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-2914`	vulnerable	2026-06-08 07:55:17.825632	Details available CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs Published: 2026-02-25T01:33:05.657Z Updated: 2026-05-10T13:28:59.114Z Open on db.gcve.eu Reference links https://www.cyberark.com/product-security/ https://docs.cyberark.com/epm/latest/en/content/release%20notes/release-notes.htm	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-22274`	vulnerable	2026-06-08 07:10:52.744672	HTML injection in CyberArk Endpoint Privilege Manager It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer. Published: 2025-02-28T12:34:08.548Z Updated: 2025-03-12T19:50:46.032Z Open on db.gcve.eu Reference links https://cert.pl/en/posts/2025/02/CVE-2025-22270/ https://cert.pl/posts/2025/02/CVE-2025-22270/ https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-22273`	vulnerable	2026-06-08 07:10:52.744365	Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer. Published: 2025-02-28T12:33:41.107Z Updated: 2025-03-05T15:53:23.083Z Open on db.gcve.eu Reference links https://cert.pl/en/posts/2025/02/CVE-2025-22270/ https://cert.pl/posts/2025/02/CVE-2025-22270/ https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-22272`	vulnerable	2026-06-08 07:10:52.744025	Self Reflected XSS in CyberArk Endpoint Privilege Manager In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is then executed in the browser. The risk of exploiting vulnerability is reduced due to the required additional bypassing the Content-Security-Policy policy This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer. Published: 2025-02-28T12:33:25.143Z Updated: 2025-03-05T15:53:02.771Z Open on db.gcve.eu Reference links https://cert.pl/en/posts/2025/02/CVE-2025-22270/ https://cert.pl/posts/2025/02/CVE-2025-22270/ https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-22271`	vulnerable	2026-06-08 07:10:52.743601	IP Spoofing in CyberArk Endpoint Privilege Manager The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer. Published: 2025-02-28T12:32:55.955Z Updated: 2025-03-05T15:49:31.652Z Open on db.gcve.eu Reference links https://cert.pl/en/posts/2025/02/CVE-2025-22270/ https://cert.pl/posts/2025/02/CVE-2025-22270/ https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-22270`	vulnerable	2026-06-08 07:10:52.743184	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-9627`	vulnerable	2026-06-08 05:14:25.866630	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-14894`	vulnerable	2026-06-08 05:10:53.654459	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Endpoint Privilege Manager

PURL mappings

Vulnerability references

Contribute