Cyber Ark's disclosed vulnerabilities center on its Password Vault Web Access product, a widely deployed privileged-access management solution that serves as a critical control point for credential and session governance in enterprise environments. The vendor's footprint remains compact within the privileged-account-management space; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cyber Ark over time
Signals from CVEs in this vendor scope (32 CVEs).
32 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-7442CRITICAL An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read arbitrary files or p | May 8, 2019 | 9.8 | 58 | NO | YES |
CVE-2018-9843CRITICAL The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET object in an Authorizat | Apr 12, 2018 | 9.8 | 51 | NO | YES |
CVE-2018-14894HIGH CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file) to bypass intended access restrictions and execute blocked | Apr 9, 2019 | 7.8 | 36 | NO | YES |
CVE-2018-9842MEDIUM CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replaying a logon message. | Apr 12, 2018 | 5.3 | 36 | NO | YES |
CVE-2017-11197HIGH In CyberArk Viewfinity 5.5.10.95 and 6.x before 6.1.1.220, a low privilege user can escalate to an administrative user via a bug within the "add printer" option. | May 3, 2023 | 7.8 | 35 | NO | YES |
CVE-2025-49827CRITICAL Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.22.0 and Secrets Manager, Self-Hosted (formerly known as Conjur | Jul 15, 2025 | 9.8 | 31 | NO | NO |
CVE-2025-49831CRITICAL An attacker of Secrets Manager, Self-Hosted installations that route traffic from Secrets Manager to AWS through a misconfigured network device can reroute authentication requests | Jul 15, 2025 | 9.8 | 28 | NO | NO |
CVE-2020-4062CRITICAL In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the Conjur Postgres database with an open port. This allows an a | Jun 22, 2020 | 9.0 | 28 | NO | NO |
CVE-2018-13052CRITICAL In CyberArk Endpoint Privilege Manager (formerly Viewfinity), Privilege Escalation is possible if the attacker has one process that executes as Admin. | Jul 5, 2018 | 9.8 | 28 | NO | NO |
CVE-2019-3800HIGH CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local | Aug 5, 2019 | 7.8 | 26 | NO | NO |
Signals from CVEs in this vendor scope (32 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cyber Ark.
Media articles that mention a CVE ID that affects a product developed by Cyber Ark — matched by CVE ID, not by vendor name.