Cybersecurity researchers have uncovered a significant number of vulnerabilities in enterprise secure vault systems from CyberArk and HashiCorp, presenting serious risks for corporate identity systems. The vulnerabilities, numbered at 14 and collectively named "Vault Fault," can potentially allow attackers to extract sensitive enterprise data, including secrets and tokens.
The flaws affect several products: CyberArk Secrets Manager, Self-Hosted, and Conjur Open Source, as well as HashiCorp Vault. Following responsible disclosure earlier this year, updates have been issued addressing these issues, including critical authentication bypasses, privilege escalation bugs, and remote code execution pathways. Notably, the most severe vulnerabilities allow attackers to take over the secure vault without needing valid credentials:
- CVE-2025-49827 (CVSS score: 9.1) – Bypass of IAM authenticator in CyberArk Secrets Manager
- CVE-2025-49828 (CVSS score: 8.6) – Remote code execution in CyberArk Secrets Manager
- CVE-2025-6000 (CVSS score: 9.1) – Arbitrary remote code execution via plugin catalog abuse in HashiCorp Vault
- CVE-2025-5999 (CVSS score: 7.2) – Privilege escalation via policy normalization in HashiCorp Vault
Additionally, vulnerable mechanisms in the lockout protection of HashiCorp Vault could allow unauthorized users to identify valid usernames and reset lockout counters. Other findings detail flaws that weaken multifactor authentication and lockout enforcement as well.
CyberArk’s vulnerabilities further highlight possible exploitation pathways where attackers could traverse from unauthenticated access to remote code execution by impersonating policy resources and executing malicious payloads assigned to new hosts.
This situation is exacerbated by emerging threats from other software, such as flaws reported in Dell’s ControlVault firmware. Attackers could leverage vulnerabilities in this system to maintain access even after operating system reinstalls, undermining security measures.
Security experts advise that organizations using these affected services implement the patches provided and optimize their vulnerability management to mitigate risks.
Welcome to DediRock, your trusted partner in high-performance hosting solutions. At DediRock, we specialize in providing dedicated servers, VPS hosting, and cloud services tailored to meet the unique needs of businesses and individuals alike. Our mission is to deliver reliable, scalable, and secure hosting solutions that empower our clients to achieve their digital goals. With a commitment to exceptional customer support, cutting-edge technology, and robust infrastructure, DediRock stands out as a leader in the hosting industry. Join us and experience the difference that dedicated service and unwavering reliability can make for your online presence. Launch our website.