CVE-2026-45165

waiting for further signals

EUVD-2026-102300 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Palo Alto Networks Idira Secrets Manager (Self-Hosted) >= 13.9, < 13.9.1

fixed in 13.9.1

CWE-863 Incorrect Authorization

ETK-2026-1739, permanent identifier

cvss8.6cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:M/U:Amber

3d 03h 07msince last run

22mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+54h40m

+2h

+4h

+6h

+8h

+10h

description

Idira Secrets Manager (Self-Hosted) version 13.9.0 has an authorization flaw affecting policy branches. An authenticated user with limited privileges may perform unauthorized branch actions, potentially accessing secrets, changing branch administrative controls, or disrupting service.

mitigation

Upgrade Idira Secrets Manager (Self-Hosted) to version 13.9.1. Restrict access to affected policy branches to only necessary authenticated users until the upgrade is complete.

fixed in 13.9.1

check

exploit

automation

contextual

auth required

yes, low privileges

EPSS

0.21%10th percentile

agent run time

22m

cve.org record, t = 0

2026-10-15 19:00Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-15 19:00Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-45165

this entry in the feed

GET /api/v1/feed/CVE-2026-45165

{
  "etk_id": "ETK-2026-1739",
  "cve_id": "CVE-2026-45165",
  "display_id": "CVE-2026-45165",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-102300",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authorization in Idira Secrets Manager",
  "summary": "Idira Secrets Manager (Self-Hosted) version 13.9.0 has an authorization flaw affecting policy branches. An authenticated user with limited privileges may perform unauthorized branch actions, potentially accessing secrets, changing branch administrative controls, or disrupting service.",
  "mitigation": "Upgrade Idira Secrets Manager (Self-Hosted) to version 13.9.1. Restrict access to affected policy branches to only necessary authenticated users until the upgrade is complete.",
  "vendor": "Palo Alto Networks",
  "product": "Idira Secrets Manager (Self-Hosted)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 13.9, < 13.9.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "13.9.1"
      ],
      "package_name": "Idira Secrets Manager (Self-Hosted)",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:M/U:Amber",
  "epss_score": 0.0021,
  "epss_percentile": 0.1021,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.587649666666668,
  "t0_at": "2026-10-15T19:00:55.521000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-15T19:00:55.521000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T19:00:55.521000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45165"
    }
  }
}

published 2026-10-16 00:14Z
last change 2026-10-21 00:18Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.