ZSP for Entra groups is now available
ZSP for Entra Groups allows for dynamic and temporary assignment of users to Entra groups within your Microsoft Entra ID directories. This means users can be granted access to specific M365 services or applications only when they need it, and for a limited time, without the need to manage the different roles in the ZSP policy.
“Secure Cloud Access and it’s new Zero Standing Privilege (ZSP) feature for Entra Groups allows for dynamic and temporary assignment of users to Entra groups within Microsoft Entra ID directories. This means users can be granted access to specific M365 services or applications only when they need it, and for a limited time, without the need to manage the different roles in the ZSP policy.”
CyberArk: CA25-35 – Possible race condition that may lead to denial of service (DoS) by unauthenticated users.
Issued: October 29, 2025
Updated: N/A
Version: 1.0
Severity: High
CVSS Score: 8.7
Third-party publication / CVE: N/A
Impact: Possible race condition that may lead to denial of service (DoS) by unauthenticated users.
Affected Products And Versions: Privileged Session Manager for SSH (PSMP), Self-Hosted – All versions prior to version 14.6.1 – All product subsets are affected
Resolution:
Upgrade to a patch version from the table below by downloading the patch from the respective link and following the instructions in our online documentation.
If a patch isn’t available for your installed version, or if you want to move to the latest available version, upgrade your component according to the upgrade version compatibility docs.
PSM for SSH 14.6 (LTS) and its patches prior to 14.6.1 – Patch to version 14.6.1 – Download patch – Documentation
PSM for SSH 14.2 (LTS) and its patches prior to 14.2.3 – Patch to version 14.2.3 – Download patch – Documentation
Temporary Mitigation:
There is no temporary mitigation available for this security bulletin.
CyberArk: CA25-34 – Possible Denial of Service (DoS) attack on HTML5 Gateway server
Issued: October 29, 2025
Updated: N/A
Version: 1.0
Severity: High
CVSS Score: 8.1
Third-party publication / CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-50106 (https://nvd.nist.gov/vuln/detail/CVE-2025-50106)
https://nvd.nist.gov/vuln/detail/cve-2024-30172 (https://nvd.nist.gov/vuln/detail/cve-2024-30172)
Impact: Possible Denial of Service (DoS) attack on HTML5 Gateway server
Affected Products And Versions:
HTML5 Gateway Container and RPM, Self-Hosted – All versions prior to version 14.6 (incl.) – All product subsets are affected
Resolution:
Upgrade to a patch version from the table below by downloading the patch from the respective link and following the instructions in our online documentation.
If a patch isn’t available for your installed version, or if you want to move to the latest available version, upgrade your component according to the upgrade version compatibility docs.
Version 14.6 – Patch to version 14.6.1 – Download patch – Documentation
Version 14.2 – Patch to version 14.2.2 – Download patch – Documentation
Version 14.0 – Patch to version 14.0.2 – Download patch – Documentation
Temporary Mitigation:
There is no temporary mitigation available for this security bulletin.
CyberArk: CA25-33 – Possible DoS attack by locking application users
Issued: October 8, 2025
Updated: N/A
Version: 1.0
Severity: High
CVSS Score: 8.2
Third-party publication / CVE: N/A
Impact: Possible DoS attack by locking application users
Affected products and versions:
Vault Self-Hosted – All versions
* This Security Bulletin applies only to the listed affected products. If this issue also affects another CyberArk product, it will be addressed separately in accordance with CyberArk’s Product Vulnerability Management Policy.
** Relates only to versions that are within their development life cycle. Please refer to our End of Life policy for details.
Resolution
Upgrade to a patch version from the following table by downloading the patch from the respective link and following the instructions in our online documentation.
If a patch isn’t available for your installed version, or if you want to move to the latest available version, upgrade your component according to the upgrade version compatibility documentation.
Installed Version:
Vault 14.6 and its patches prior to 14.6.2 – Patch version 14.6.2 – https://www.cyberark.com/CA25-33-VaultSH-14.6.2 – docs
Vault 14.2 and its patches prior to 14.2.4 – Patch version 14.2.4 – https://www.cyberark.com/CA25-33-VaultSH-14.2.4 – docs
Vault 14.0 and its patches prior to 14.0.5 – Patch version 14.0.5 – https://www.cyberark.com/CA25-33-VaultSH-14.0.5 – docs
CyberArk recommends enforcing strong password complexity requirements for all system accounts, including both human and non-human users. For detailed settings, please refer to the passparm.ini configuration file.
PAM on Cloud customers: CyberArk will not release AWS AMIs and Azure VM Images. Customers should run the upgrade process on the provided images following deployment.
Temporary mitigation
There is no temporary mitigation available for this security bulletin.
Exploited in the wild in a CyberArk environment
Not to the best of CyberArk’s knowledge.
Technical FAQ
Do I need to upgrade my Disaster Recovery Vault, PAReplicate, and EVD as well?
Disaster Recovery Vault and EVD versions (and patch version) need to be aligned with the Vault’s patch version.
PAReplicate should be the same minor version as the Vault (for example, PAReplicate 14.2 is compatible with Vault 14.2.2).
As CyberArk receives questions related to this Security Bulletin, answers will be added to the Technical FAQ article. To stay informed of updates, open the FAQ article and click Follow to receive notifications when new questions and answers are published.
