Overview

• Cyata researchers uncovered 14 critical CVEs in CyberArk Conjur and HashiCorp Vault, including the first remote code execution flaw in Vault’s 10-year history and an unauthenticated RCE chain in Conjur.
• Coordinated disclosures to CyberArk and HashiCorp in May led to CVE assignments in June and the release of patches for Conjur on July 15 followed by Vault updates later that month.
• The Conjur exploit abuses default AWS integration to bypass IAM authentication while Vault’s plugin logic vulnerability enables attackers to gain full system control.
• Cyata CEO Shahar Tal and lead researcher Yarden Porat demonstrated detailed exploit chains at Black Hat USA, underscoring logic flaws and misconfigurations likely present for years.
• No active exploitation has been observed so far, but enterprises are urged to apply the patches immediately, audit vault logs, deploy detection tools and tighten access controls.