A set of high-severity vulnerabilities have recently been discovered. Generally known as “Vault Fault” by popular secrets management platforms like CyberArk and HashiCorp Vault.
These flaws could let attackers remotely gain full control of enterprise vaults without credentials, posing a major risk to infrastructure and data.
What’s Affected?
- CyberArk Secrets Manager (Self-Hosted)
- CyberArk Conjur OSS
- HashiCorp Vault (Community & Enterprise Editions)
Key Vulnerabilities:
- CVE2025-49827 (CVSS 9.1): IAM authenticator bypass in CyberArk
- CVE2025-49828: Remote Code Execution in CyberArk
- CVE2025-6000 (CVSS 9.1): Plugin-catalog-based RCE in HashiCorp Vault
- CVE2025-5999: Privilege escalation in HashiCorp Vault
Other risks include:
- Authentication bypass
- Weak brute-force protections
- MFA circumvention
What Should You Do?
Patch Immediately
- CyberArk: Update to 13.5.1 or 13.6.1
- Conjur OSS: Update to 1.22.1
- HashiCorp Vault: Update to 1.20.2 or latest Enterprise versions
Secure Your Vaults
- Limit exposed endpoints
- Enforce least privilege access
- Implement Zero Trust architecture
- Monitor API activity for anomalies
.jpg)
.png)
.png)