https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-2914.htmlhttps://patchthecve.com/cve/CVE-2026-2914.htmlWed, 17 Jun 2026 10:32:01 +0000HIGH 7.8: CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogshttps://patchthecve.com/cve/CVE-2025-66374.htmlhttps://patchthecve.com/cve/CVE-2025-66374.htmlWed, 17 Jun 2026 09:56:44 +0000HIGH 7.8: CyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve privilege escalation through policy elevation of an Administration task.https://patchthecve.com/cve/CVE-2025-49831.htmlhttps://patchthecve.com/cve/CVE-2025-49831.htmlWed, 17 Jun 2026 09:31:58 +0000CRITICAL 9.8: An attacker of Secrets Manager, Self-Hosted installations that route traffic from Secrets Manager to AWS through a misconfigured network device can reroute authentication requests to a malicious server under the attacker’s control. CyberArk believes there to be very few installations where this issuhttps://patchthecve.com/cve/CVE-2025-49830.htmlhttps://patchthecve.com/cve/CVE-2025-49830.htmlWed, 17 Jun 2026 09:31:58 +0000MEDIUM 6.5: Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy yaml parser to reference files on the Secrets Manager, Self-Hosted server. These references may be used as reconnaissance to better understand the fhttps://patchthecve.com/cve/CVE-2025-49829.htmlhttps://patchthecve.com/cve/CVE-2025-49829.htmlWed, 17 Jun 2026 09:31:58 +0000MEDIUM 6.5: Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager, Self-Hosted allows authenticated attackers to inject resources into the database and to bypass permission checks. This issue affects Secrets Manager, Self-Hosted (formerly Conjur Ehttps://patchthecve.com/cve/CVE-2025-49828.htmlhttps://patchthecve.com/cve/CVE-2025-49828.htmlWed, 17 Jun 2026 09:31:58 +0000HIGH 8.8: Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secrethttps://patchthecve.com/cve/CVE-2025-49827.htmlhttps://patchthecve.com/cve/CVE-2025-49827.htmlWed, 17 Jun 2026 09:31:57 +0000CRITICAL 9.8: Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.22.0 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.5 and 13.6 are vulnerable to bypass of the IAM authenticator. An attacker who can manipulathttps://patchthecve.com/cve/CVE-2024-54840.htmlhttps://patchthecve.com/cve/CVE-2024-54840.htmlWed, 17 Jun 2026 08:10:44 +0000MEDIUM 4.2: PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection.https://patchthecve.com/cve/CVE-2024-42340.htmlhttps://patchthecve.com/cve/CVE-2024-42340.htmlWed, 17 Jun 2026 07:49:17 +0000HIGH 8.3: CyberArk - CWE-602: Client-Side Enforcement of Server-Side Securityhttps://patchthecve.com/cve/CVE-2024-42339.htmlhttps://patchthecve.com/cve/CVE-2024-42339.htmlWed, 17 Jun 2026 07:49:17 +0000MEDIUM 4.3: CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actorhttps://patchthecve.com/cve/CVE-2024-42338.htmlhttps://patchthecve.com/cve/CVE-2024-42338.htmlWed, 17 Jun 2026 07:49:17 +0000MEDIUM 4.3: CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actorhttps://patchthecve.com/cve/CVE-2024-42337.htmlhttps://patchthecve.com/cve/CVE-2024-42337.htmlWed, 17 Jun 2026 07:49:17 +0000MEDIUM 4.3: CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor