CVE-2025-22273 - CVE House

Back to Database

Status published Critical CVE-2025-22273

Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager

9.3 CVSS

Vulnerability Description

Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-22273

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Karol Mazurek (Afine Team)
Maksymilian Kubiak (Afine Team)

References

More from CyberArk

View All →

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor...

HTML injection in CyberArk Endpoint Privilege Manager

Self Reflected XSS in CyberArk Endpoint Privilege Manager

IP Spoofing in CyberArk Endpoint Privilege Manager

Stored XSS in CyberArk Endpoint Privilege Manager

Affected Vendor

CyberArk

View all reports →

Affected Software

Endpoint Privilege Manager

Vulnerable Versions:

24.7.1

Timeline

Official Publish: February 28th, 2025

Last Modified: March 5th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1498 Network Denial of Service

T1190 Exploit Public-Facing Application

T1562 Impair Defenses

Defense Evasion

T1046 Network Service Discovery