Incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) allows an authenticated, low‑privileged user to inject and execute arbitrary operating‑system commands on the PSMP host. The flaw is located in command handling logic that fails to neutralize special elements, resulting in a classic OS command‐injection weakness (CWE‑78). This can directly compromise the integrity and availability of the PSMP service by allowing the attacker to run any command on its host.

The affected products are CyberArk Software, a Palo Alto Networks Company’s PAM Self‑Hosted and Privilege Cloud solutions. Versions prior to 15.0.2, 14.6.3, 14.2.5 and 14.0.6 contain the vulnerability as detailed in the vendor release notes.

The CVSS score of 8.7 indicates a high severity vulnerability, and the EPSS score is not available, while it is not listed in the CISA KEV catalog. Exploitation requires a legitimate, authenticated account with low privileges accessing the PSMP web interface; once authenticated, the attacker can trigger the flaw to run arbitrary OS commands on the host, presenting a significant security risk for environments running vulnerable versions.