CVE-2024-54840: Cyberark Privileged Access Manager

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection.

Affected products

• Cyberark Privileged Access Manager: before 14.4 (fixed in 14.4)

Published 2025-02-03. Last modified 2026-06-17.