CyberArk (now Idira, the Palo Alto Networks identity security platform) published security bulletins CA26-37 and CA26-38.

The public Technical Community notice, edited 4 August 2026, says CA26-37 is High severity and affects Privilege Cloud Central Policy Manager (CPM), all versions prior to 15.0, and CA26-38 is High severity and affects Secrets Manager, Self Hosted, version 13.9.0. Full technical detail sits behind the CyberArk/Idira Technical Community login.

No CVE identifiers or CVSS vectors are in that public post. Idira is the May 2026 rebrand of CyberArk after the Palo Alto Networks acquisition; it is not a separate invented product. Confirm the exact patched builds from the logged-in bulletins before upgrading.

UPDATE 15–16 October 2026: Palo Alto Networks, as CVE numbering authority, published CVE-2026-45165 for the CA26-38 Secrets Manager flaw on 15 October. The CVE record describes improper authorisation in the REST API (CWE-863) of Idira Secrets Manager (Self-Hosted), also referred to as Conjur, version 13.9.0: an authenticated user with limited privileges can perform unauthorised actions on a policy branch and, under specific circumstances, retrieve secrets they should not see, alter administrative access controls on the branch, or cause a denial of service.

It is rated CVSS 4.0 8.6 High, with no exploitation recorded in the CVE record's SSVC data. The fix is Secrets Manager Self-Hosted 13.9.1, per the vendor release notes linked from the CVE record.

Canada's Cyber Centre issued advisory AV26-1056 on 16 October covering the same product (prior to 13.9.1).