Affected products and versions:

• Secure Infrastructure Access: The following SIA connection types are affected when accessed by users authenticated via a federated identity provider (external IdP):SIA-RDPSIA-SSH

* This Security Bulletin applies only to the listed affected products. If this issue also affects another CyberArk product, it will be addressed separately in accordance with CyberArk’s Product Vulnerability Management Policy.

** Relates only to versions that are within their development life cycle. Refer to our End of Life policy for details.

Resolution: To address this, connections via Secure Infrastructure Access (SIA) now include an additional, optional authentication factor.

After the initial authentication step, users will be prompted to enter a PIN code in the native client, as part of the SIA authentication flow.

To enable the additional authentication factor, follow the steps below:

1. Log in to the Identity Administration portal.
2. Navigate to: Core Services → Policies
3. Choose an existing policy to edit or click Add Policy Set to create a new one.
4. Navigate to: Authentication Policies → CyberArk Identity Security Platform
5. Set the drop-down menu Enable authentication policy controls to Yes.
6. Check the box for Enable PIN code protection for native clients.
7. Click Save.

It’s important to note that even if the flag is already enabled, you still need to click ‘Save’ for the new flow to apply.

Temporary mitigation:

There is no temporary mitigation available for this security bulletin.

Product:

• SSH Manager for Machines (formerly known as SSH Protect) – All versions prior to version 25.1
• Code Signing Manager (formerly known as CodeSign Protect) – All versions prior to version 25.1
• Certificate Manager, Self-Hosted (formerly known as TLS Protect Datacenter) – All versions prior to version 25.1

* This security bulletin applies only to the listed affected products. If this issue also affects another CyberArk product, it will be addressed in a separate security bulletin.

** Relates only to versions that are within their development life. Please refer to our End-of-Life policy for details

Resolution

Upgrade to a patch version by downloading the patch from the respective link and following the instructions in our online documentation.

If a patch isn’t available for your installed version, or if you want to move to the latest available version, upgrade your component according to the upgrade version compatibility docs.

Want to dive deeper? Check it out here

* This Security Bulletin applies only to the listed affected products. If this issue also affects another CyberArk product, it will be addressed separately in accordance with CyberArk’s Product Vulnerability Management Policy.

** Relates only to versions that are within their development life cycle. Refer to our End of Life policy for details.

Resolution:

Upgrade to a patch version by downloading the patch from the respective link and following the instructions in our online documentation.

Want to dive deeper? Check it out here

Affected products and versions

• Secrets Manager, SaaS (formerly Conjur Cloud) Edge – All versions prior to version 15.0

* This security bulletin applies only to the listed affected products. If this issue also affects another CyberArk product, it will be addressed separately in accordance with CyberArk’s Product Vulnerability Management Policy.

** Relates only to versions that are within their development life. Please refer to our End-of-Life policy for details

Resolution

Upgrade to a version by downloading the version from the respective link and following the instructions in our online documentation.

Want to dive deeper? Check it out here