CyberArk EPM 24.7.1 – Unrestricted Brute Force to /ChangePassword
CVE-2025-22273 Published on February 28, 2025

Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager
Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.

NVD

Weakness Type

Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.


Products Associated with CVE-2025-22273

Want to know whenever a new CVE is published for CyberArk Endpoint Privilege Manager? stack.watch will email you.

CyberArk Endpoint Privilege Manager
 

Affected Versions

CyberArk Endpoint Privilege Manager Version 24.7.1 is affected by CVE-2025-22273

Exploit Probability

EPSS
0.23%
Percentile
45.09%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.