CVE-2018-9842

MEDIUM

CyberArk Password Vault < 9.7 - Exposure of Sensitive Information via Logon Message Replay

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2018-9842. PoCs published by Thomas Zuk, RedTeam Pentesting.

AI-analyzed exploit summary This exploit targets a memory disclosure vulnerability in CyberArk's proprietary protocol on port 1858. It sends a crafted login request to leak memory contents, writing the responses to a file for analysis.

Description

CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replaying a logon message.

Exploits (3)

exploitdb WORKING POC
by Thomas Zuk · pythonremotewindows
https://www.exploit-db.com/exploits/45926

This exploit targets a memory disclosure vulnerability in CyberArk's proprietary protocol on port 1858. It sends a crafted login request to leak memory contents, writing the responses to a file for analysis.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: CyberArk Privileged Account Security Solution < 9.7 and < 10
No auth needed
Prerequisites: Network access to the target's port 1858
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Thomas Zuk · pythonremotelinux
https://www.exploit-db.com/exploits/44829

This exploit targets a memory disclosure vulnerability in CyberArk's proprietary protocol on port 1858. It sends a crafted login request to trigger the vulnerability and dumps the server's memory response to a file.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: CyberArk Privileged Account Security Solution < 9.7 and < 10
No auth needed
Prerequisites: Network access to the target's port 1858
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP
by RedTeam Pentesting · textdoslinux
https://www.exploit-db.com/exploits/44428

This is a detailed advisory describing an information disclosure vulnerability in CyberArk Password Vault. The vulnerability allows an attacker to retrieve approximately 50 bytes of memory from the vault by replaying a captured logon request.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: CyberArk Password Vault < 9.7, < 10
No auth needed
Prerequisites: Network access to the CyberArk Password Vault on TCP port 1858 · A captured logon request packet
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44428/
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2018/Apr/19
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040674
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45926/
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44829/
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/541931/100/0/threaded

Scores

CVSS v3 5.3
EPSS 0.1386
EPSS Percentile 96.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200
Status published
Products (1)
cyberark/password_vault < 9.7
Published Apr 12, 2018
Tracked Since Feb 18, 2026