CVE-2026-45172: Idira PSMP Arbitrary Command Execution – Patch Guidance

Technical summary

CVE-2026-45172 is a command injection vulnerability (CWE-78) in Idira PSMP versions before 15.0.2, 14.6.3, 14.2.5, and 14.0.6. The vulnerability stems from inadequate input validation that fails to properly sanitize user-supplied input before passing it to system commands. An authenticated user with low privilege level can craft malicious input that breaks out of the intended command context and executes arbitrary shell commands with PSMP process privileges. The attack requires network access and valid credentials but no user interaction or elevated starting privileges.

Business impact

Successful exploitation compromises the confidentiality, integrity, and availability of the PSMP system. Since PSMP manages privileged SSH sessions and typically stores sensitive credentials and session recordings, an attacker gaining command execution can steal credentials for critical systems, modify or delete audit logs to hide malicious activity, disrupt session management for legitimate users, and potentially pivot to protected systems that PSMP guards access to. The reputational and compliance risks are severe if audit trails are tampered with or if downstream systems are breached via stolen credentials.

Affected systems

Idira Privileged Session Manager for SSH is affected in the following versions: any release prior to 15.0.2 in the 15.x branch, prior to 14.6.3 in the 14.6 branch, prior to 14.2.5 in the 14.2 branch, and prior to 14.0.6 in the 14.0 branch. Organizations must verify their current PSMP version against these fixed versions. Verify exact patch versions against Palo Alto Networks security bulletins CA26-17 and CA26-18.

Exploitability

Exploitability is high among organizations where PSMP is deployed, but the attack requires an authenticated user with valid credentials. The vector is network-based with low attack complexity, meaning an attacker can exploit it remotely without special conditions once authenticated. The absence of KEV status indicates this has not yet been observed in active exploitation campaigns at the time of publication, but the straightforward nature of input validation flaws and the high access level granted by PSMP make this attractive to threats with insider access or those targeting organizations where credential compromise has already occurred.

Remediation

Upgrade Idira PSMP to a patched version immediately: 15.0.2 or later for 15.x deployments, 14.6.3 or later for 14.6 deployments, 14.2.5 or later for 14.2 deployments, or 14.0.6 or later for 14.0 deployments. Verify exact version numbers and any prerequisite steps in Palo Alto Networks security bulletins CA26-17 and CA26-18 before patching. If immediate patching is not feasible, restrict authenticated access to PSMP to trusted accounts only and monitor all command execution logs for anomalous activity.

Patch guidance

Follow Palo Alto Networks' guidance in security bulletins CA26-17 and CA26-18 for detailed patch instructions, including any prerequisites or post-patch validation steps. Organizations running multiple PSMP versions should prioritize upgrading systems on the oldest branch (14.0.x) first, then 14.2.x, 14.6.x, and finally 15.x. Test patches in a non-production environment before deploying to production PSMP systems to ensure session continuity and that no audit functionality is disrupted. Schedule patching during maintenance windows to minimize service interruption.

Detection guidance

Monitor PSMP logs for suspicious command execution patterns, particularly commands that appear to originate from low-privileged user sessions. Look for evidence of shell metacharacters (pipes, semicolons, backticks, command substitution syntax) in input that should be alphanumeric. Enable enhanced logging for all PSMP administrative commands if available. Network-based detection is difficult, but monitoring for unexpected outbound connections from PSMP to external systems may indicate post-exploitation activity. Correlate authentication logs with command execution logs to identify accounts used for exploitation.

Why prioritize this

This vulnerability merits immediate prioritization because it affects a system (PSMP) that is explicitly designed to protect other critical infrastructure, creating a cascading risk. The CVSS score of 8.8 reflects high severity, and the authentication requirement, while limiting exposure, is often a weak control in environments where PSMP is deployed—such systems frequently have shared or contractor accounts. The integrity impact (ability to modify or delete audit logs) is particularly severe in regulated environments. Although KEV status is currently false, the simplicity of input validation exploits means active exploitation is likely once word spreads among threat actors.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the complete compromise of PSMP confidentiality, integrity, and availability, combined with network-based unauthenticated access and low attack complexity. The requirement for prior authentication (PR:L) prevents a perfect 10.0 but does not materially reduce risk in real-world deployments where internal threats or credential compromise are common. The score appropriately emphasizes that this is a post-authentication privilege escalation with maximum impact on the compromised host.

Frequently asked questions