Critical severityNVD Advisory· Published Feb 28, 2025· Updated Apr 15, 2026
CVE-2025-22273
CVE-2025-22273
Description
Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use.
This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: = 24.7.1 (SaaS)
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.