CVE-2021-31798: Cyberark Credential Provider

Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days.

The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious user can obtain the plaintext of cache files.

Affected products

• Cyberark Credential Provider: before 12.1 (fixed in 12.1)

Published 2021-09-02. Last modified 2026-06-17.