How many CyberArk endpoint privilege manager CVEs are in CISA KEV?

None of CyberArk endpoint privilege manager's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of CyberArk endpoint privilege manager are affected?

13 distinct CyberArk endpoint privilege manager versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in CyberArk endpoint privilege manager CVEs?

CyberArk endpoint privilege manager's CVEs most often map to these CWE weakness types: CWE-269 (Improper Privilege Management), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-290 (Authentication Bypass by Spoofing), CWE-770 (Allocation of Resources Without Limits or Throttling).

What is the average severity of CyberArk endpoint privilege manager CVEs?

The average CVSS base score across CyberArk endpoint privilege manager's scored CVEs is 6.7.

RadicalNotion.AI

Log in Start free

CyberArk

13 CVEs

CyberArk endpoint privilege manager Vulnerabilities

Name: CyberArk endpoint privilege manager vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for endpoint privilege manager by CyberArk.

13

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

2

Public exploits

PoC or exploit code

6.7

Avg CVSS

2018–2026

Last updated February 25, 2026

Overview

CyberArk endpoint privilege manager has 13 published CVE records since 2018, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 2 have a known public exploit. The average CVSS base score across scored CVEs is 6.7.

This page aggregates every publicly disclosed vulnerability (CVE) affecting CyberArk endpoint privilege manager, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include saas.

Severity and exploitation

How the CVSS severity of CyberArk endpoint privilege manager's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High6

Medium3

Low2

In CISA’s Known Exploited Vulnerabilities catalog

0

None of CyberArk endpoint privilege manager's CVEs are currently listed in CISA's KEV catalog.

Public exploits

2

2 of CyberArk endpoint privilege manager's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every CyberArk endpoint privilege manager version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

>= 24.7.15 CVEs
< 10.71 CVE
< 25.11.01 CVE
<= 10.2.1.6031 CVE
<= 25.10.01 CVE
10.2.1.603 <= v <= 10.2.1.6031 CVE
11.1.0.173 <= v <= 11.1.0.1731 CVE
11.5.3.328 <= v < 11.5.4.3551 CVE
11.5.3.328 <= v < 11.5.4.5001 CVE

Fixed in

10.71 CVE
11.5.4.3551 CVE
11.5.4.5001 CVE
25.11.01 CVE

Find a version

13 CVEs

Sort

High vulnerability · 2026-02-25
CVE-2026-2914
Patch
CWE-269
High · CVSS 8.5
EPSS 0.1% (4th pct)2026-02-25
High vulnerability · 2026-02-03
CVE-2025-66374CWE-269
High · CVSS 7.8
EPSS 0.2% (13th pct)2026-02-03
HTML injection in CyberArk Endpoint Privilege Manager
CVE-2025-22274CWE-80
Low · CVSS 2.0
EPSS 0.5% (39th pct)2025-02-28
Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager
CVE-2025-22273CWE-770
Critical · CVSS 9.3
EPSS 0.6% (47th pct)2025-02-28
Self Reflected XSS in CyberArk Endpoint Privilege Manager
CVE-2025-22272CWE-79
Low · CVSS 2.1
EPSS 0.5% (38th pct)2025-02-28
IP Spoofing in CyberArk Endpoint Privilege Manager
CVE-2025-22271CWE-290
Medium · CVSS 6.9
EPSS 0.4% (35th pct)2025-02-28
Stored XSS in CyberArk Endpoint Privilege Manager
CVE-2025-22270CWE-79
High · CVSS 7.3
EPSS 0.6% (48th pct)2025-02-28
High vulnerability · 2022-01-15
CVE-2021-44049
Patch
High · CVSS 7.8
EPSS 0.4% (34th pct)2022-01-15
Medium vulnerability · 2020-11-27
CVE-2020-25738
Medium · CVSS 5.5
EPSS 0.4% (37th pct)2020-11-27
High vulnerability · 2019-04-09
CVE-2018-14894
Public exploit
High · CVSS 7.8
EPSS 1.9% (79th pct)2019-04-09
High vulnerability · 2019-03-08
CVE-2019-9627
Patch
High · CVSS 7.0
EPSS 0.4% (34th pct)2019-03-08
Critical vulnerability · 2018-07-05
CVE-2018-13052
Critical · CVSS 9.8
EPSS 1.2% (66th pct)2018-07-05
Medium vulnerability · 2018-06-26
CVE-2018-12903
Public exploit
Medium · CVSS 5.4
EPSS 0.6% (48th pct)2018-06-26

Common weakness types

The CWE weakness categories most often found in CyberArk endpoint privilege manager CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many CyberArk endpoint privilege manager CVEs were published each year.

2018

2

2019

2

2020

1

2022

1

2025

5

2026

2

Other CyberArk products

Browse vulnerabilities for other products by CyberArk.

identity6 CVEs conjur5 CVEs CyberArk Identity Management4 CVEs credential provider3 CVEs Idira Endpoint Privilege Manager3 CVEs Secrets Manager, Self-Hosted3 CVEs conjur OSS2 CVEs password vault2 CVEs

All CyberArk vulnerabilities

Frequently asked questions

Common questions about CyberArk endpoint privilege manager vulnerabilities.

How many CVEs does CyberArk endpoint privilege manager have?: CyberArk endpoint privilege manager has 13 published CVE records since 2018.
How many CyberArk endpoint privilege manager CVEs are in CISA KEV?: None of CyberArk endpoint privilege manager's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for CyberArk endpoint privilege manager vulnerabilities?: Yes — 2 of CyberArk endpoint privilege manager's CVEs have a known public exploit.
Which versions of CyberArk endpoint privilege manager are affected?: 13 distinct CyberArk endpoint privilege manager versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in CyberArk endpoint privilege manager CVEs?: CyberArk endpoint privilege manager's CVEs most often map to these CWE weakness types: CWE-269 (Improper Privilege Management), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-290 (Authentication Bypass by Spoofing), CWE-770 (Allocation of Resources Without Limits or Throttling).
How many critical CyberArk endpoint privilege manager vulnerabilities are there?: CyberArk endpoint privilege manager has 2 critical and 6 high-severity CVEs.
What is the average severity of CyberArk endpoint privilege manager CVEs?: The average CVSS base score across CyberArk endpoint privilege manager's scored CVEs is 6.7.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track CyberArk endpoint privilege manager vulnerabilities

Monitor new CyberArk endpoint privilege manager vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing