The vulnerability is an improper access control flaw in the internal agent validation processes of Idira Endpoint Privilege Manager. Because of this flaw, a local attacker could bypass built‑in security controls or cryptographic validations, effectively circumventing the agent’s self‑defense mechanisms. The result may be execution of unauthorized operations on the compromised system, as the flaw is categorized as CWE‑295 and has a CVSS score of 8.5.

The flaw affects Idira Endpoint Privilege Manager agents running on Linux, macOS, and Windows that are at a version lower than 26.5. All affected agents exhibit the same improper validation behavior and are listed under the CyberArk Software, a Palo Alto Networks Company product.

The vulnerability has a high severity rating of 8.5. Its EPSS score is not available, so the precise exploitation probability is uncertain, but the absence of a KEV listing indicates no confirmed widespread exploitation yet. The attack vector, as the description states, requires local access to the agent; an attacker with sufficient local privileges can exploit the flaw to elevate privileges or execute arbitrary code.