Critical severity · published Feb 28, 2025
CVE-2025-22273
Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager
9.3
CVSS
0.6%
EPSS
No
On KEV
Description
Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use.
This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Endpoint Privilege Manager · CyberArk
24.7.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-22273
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-22273
cert.pl
https://cert.pl/en/posts/2025/02/CVE-2025-22270/
cert.pl
https://cert.pl/posts/2025/02/CVE-2025-22270/
docs.cyberark.com
https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm
More from Endpoint Privilege Manager
9.8
CVE-2018-13052
In CyberArk Endpoint Privilege Manager (formerly Viewfinity), Privilege Escalation is possible if the attacker has one process that executes as Admin
7.8
CVE-2026-2914
CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs
7.8
CVE-2025-66374
CyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve privilege escalation through policy elevation of an Administration task
7.8
CVE-2021-44049
CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp…
7.8
CVE-2018-14894
CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file) to bypass intended access restrictions and execute…