22 July 2026

CyberArk: CA26-35 / CA26-36

Dear Customers, On Wednesday, July 22, Idira (formerly CyberArk) has released Critical and High Severity Security Bulletins CA26-35, CA26-36 affecting z/OS Credential Provider, Terminal plugin controller (TPC),Microsoft Windows Local with WMI plugin, Database Credentials Management Framework versions.

 

Please review whether any affected components are present within your environment and prioritize remediation efforts based on the severity and business impact outlined in the associated security bulletins.

 

CA26-35 involves a Critical severity issue that affects z/OS Credential Provider, all versions prior to 14.2.7
CA26-36 involves a High severity issue that affects Terminal plugin controller (TPC), version 15.0.0 or earlier; Microsoft Windows Local with WMI plugin, version 21.0.1 or earlier; Database Credentials Management Framework, version 20.1.8 or earlier.

 

For complete details on the vulnerabilities, recommendations, and update instructions, please review the Security Bulletins, that can be found in the Technical Community:

 

https://www.cyberark.com/CA26-35
https://www.cyberark.com/CA26-36

 

Learn more by visiting Product Security | CyberArk

8 July 2026

Wednesday, July 8th, CyberArk released Security Bulletins CA26-24, CA26-25, CA26-27, CA26-28 and CA26-29

CA26-24 involves a High severity issue that affects EPM SaaS Windows Agents, all versions prior to 26.6.

 

CA26-25 involves a High severity issue that affects EPM SaaS Windows Agents, all versions prior to 26.6.

 

CA26-27 involves a High severity issue that affects Privileged Threat Analytics, Idira PAM Self-Hosted, all versions prior to version 15.2 (exclusive).

 

CA26-28 involves a High severity issue that affects Vault/Infra, Self-Hosted, all versions prior to version 15.0.3 (inclusive).

 

CA26-29 involves a High severity issue that affects Remote Control Client, all versions prior to version 15.0.3 (inclusive).

 

For complete details on the vulnerabilities, recommendations, and update instructions, please review the Security Bulletins, that can be found in the Technical Community:

https://www.cyberark.com/CA26-24

https://www.cyberark.com/CA26-25

https://www.cyberark.com/CA26-27

https://www.cyberark.com/CA26-28

https://www.cyberark.com/CA26-29

 

Learn more by visiting Product Security | CyberArk

8 June 2026

CyberArk is now Idira® – Next-Generation Identity Security Platform

On June 8th, CyberArk announced its rebrand to Idira®, a next-generation identity security platform built on CyberArk’s foundations and powered by Palo Alto Networks.

 

The transition is being rolled out in phases:

 

  • Phase 1 (Visual updates): New Idira branding will begin appearing across the product UI, documentation, and automated system emails.
  • Subsequent phases: Technical touchpoints such as product URLs and APIs will remain unchanged for now. Further updates will be communicated in advance.

 

For full details on what’s changing, visit the Idira FAQ page.

27 May 2026

CyberArk: CA26-23 – Incomplete IIS documentation for the z/OS Central Credential Provider (CCP) can cause weak authentication.

Impact: Incomplete configuration instructions in the documentation for the IIS that hosts the Central Credential Provider (CCP) for the z/OS Credential Provider can lead to weak authentication.

 

CA26-23 involves a Critical severity issue that affects:

  • z/OS Credential Provider, all versions.

For complete details on the vulnerabilities, recommendations, and update instructions, please review the Security Bulletin, that can be found in the Technical Community:

 

https://www.cyberark.com/ca26-23

 

Learn more by visiting Product Security | CyberArk

 

1 2 3 … 7