CVE-2021-31796

CVE-2021-31796 is an inadequate encryption vulnerability affecting CyberArk Credential Provider versions prior to 12.1. This flaw allows for information disclosure due to a weak encryption scheme where an attacker could potentially guess the encryption key with high probability (often a single key, rarely exceeding 2^36 possibilities). The vulnerability has a CVSS score of 7.5 (High), indicating a network-based attack with low complexity and high confidentiality impact, but no integrity or availability impact. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), it has garnered some community discussion, including a Reddit post detailing reverse engineering efforts related to decrypting CyberArk vault credential files.