Full Report
Palo Alto Networks security advisory (AV26-1056)
Analysis Summary
# Vulnerability: Idira Secrets Manager (Self-Hosted) Vulnerability, Fixed in v13.9.1 (Canadian Cyber Centre AV26-1056)
**Note on the source:** The advisory is titled "Palo Alto Networks security advisory," but the only affected product listed is Idira Secrets Manager (Self-Hosted), and the remediation link points to CyberArk documentation. Treat this as a CyberArk product vulnerability unless the vendor confirms otherwise. Verify the product owner through the vendor's official channels before acting.
## CVE Details
- CVE ID: Not provided in the advisory
- CVSS Score: Not provided
- CWE: Not provided
## Affected Systems
- Products: Idira Secrets Manager (Self-Hosted)
- Versions: All versions prior to v13.9.1
- Configurations: Not specified. The advisory covers the self-hosted deployment only.
## Vulnerability Description
The advisory confirms that a vulnerability affects Idira Secrets Manager (Self-Hosted) versions before 13.9.1. It gives no technical details, such as the vulnerability class, affected component, or trigger conditions. Consult the vendor release notes for specifics.
## Exploitation
- Status: Not stated in the advisory. Check the vendor advisory and CISA KEV for updates.
- Complexity: Not stated
- Attack Vector: Not stated
## Impact
- Confidentiality: Not stated. Secrets managers hold credentials and keys, so impact could be significant if exploited. This is an inference, not a vendor claim.
- Integrity: Not stated
- Availability: Not stated
## Remediation
### Patches
- Upgrade Idira Secrets Manager (Self-Hosted) to **v13.9.1 or later**.
### Workarounds
- None listed in the advisory. Apply the vendor update as soon as possible.
## Detection
- No indicators of compromise (IoCs) are provided.
- Recommended general steps:
- Confirm your installed version and identify any instances running versions before 13.9.1.
- Review authentication and secret-access logs for unusual activity, especially around the advisory date (October 2026).
- Restrict network access to the management interfaces of self-hosted instances.
## References
- Canadian Cyber Centre advisory: hxxps://www[.]cyber[.]gc[.]ca/fr/alertes-avis/bulletin-securite-palo-alto-networks-av26-1056
- Idira Secrets Manager 13.9.1 release notes: hxxps://docs[.]cyberark[.]com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.9.1.htm
- Palo Alto Networks security advisories: hxxps://security[.]paloaltonetworks[.]com/