CVE-2018-9023: An input validation vulnerability in CA Privileged Access Manager 2.x allows unprivileged users to execute...

Security readout for executives and security teams

CA Privileged Access Manager 2.x has an input validation flaw that can let an unprivileged user run arbitrary commands through the update_crld script. Because this is a privileged access management product, compromise could affect sensitive administrative workflows. The source bundle does not provide CVSS, fixed versions, or active exploitation evidence. Exposure is limited to environments running CA Privileged Access Manager 2.x. The bundle implies an unprivileged user context is required, but does not state whether the vulnerable script is reachable remotely, locally, or through a specific management workflow. Treat as high priority if CA PAM 2.x is present. The affected product manages privileged access, and arbitrary command execution by a lower-privileged user could create serious operational and security impact. Absence from KEV reduces evidence of current exploitation, not technical severity. Mitigation focus: Review the CA security notice for supported remediation guidance.; Inventory CA Privileged Access Manager 2.x deployments.; Prioritize upgrade or remediation according to vendor instructions..

Prepared

Jun 7, 2026, 13:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.