The vulnerability is caused by improper access control within high‑privileged components of the Idira Endpoint Privilege Manager agent, allowing a local user with limited privileges to manipulate internal communication mechanisms or file operations. If successful, the attacker can bypass permission checks and execute unauthorized local actions with elevated privileges. The primary impact is local privilege escalation.

CyberArk Software’s Idira Endpoint Privilege Manager agent versions earlier than 26.5 running on Linux, macOS, or Windows are affected. All editions of the product on these operating systems are vulnerable when the agent component is below version 26.5.

The CVSS score of 8.9 indicates a severe severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access; a low‑privileged user can send crafted messages to internal channels or modify specific files to trigger the flaw. Successful exploitation would grant the attacker elevated privileges on the host, potentially allowing further local actions. Although no public exploit is known, the severity and local‑only nature suggest that the threat level remains high for environments with unpatched agents.