Privilege Escalation Vulnerability in CyberArk Endpoint Privilege Manager
CVE-2025-66374

7.8HIGH

Key Information:

Vendor

CyberArk

Status
Endpoint Privilege Manager
Vendor
CVE Published:
3 February 2026

What is CVE-2025-66374?

The CyberArk Endpoint Privilege Manager Agent prior to version 25.10.0 is susceptible to a vulnerability that allows local users to leverage policy elevation for administration tasks, potentially leading to unauthorized privilege escalation. This can enable a user to gain elevated access rights, compromising system security and integrity. It is crucial for organizations using this product to address the issue to maintain a secure environment.

References

https://www.cyberark.com/product-security/
https://www.cyberark.com/ca26-01
https://docs.cyberark.com/epm/latest/en/content/release%2...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.