4 Get requests = 3 Domain admins: CyberArk magic you didn’t know about | SO-CON 26
Source: YouTube · SpecterOps · published Jun 4, 2026 · 45:31
This session reveals a critical CyberArk Privileged Session Manager (PSM) vulnerability that allows an attacker to compromise three domain admin accounts using just four HTTP GET requests under specific misconfiguration conditions 0:17-0:35.
Key Takeaways:
• The presenter, Marat, brings 10 years of offensive security experience from KPMG, Deloitte, and Unit 42 to demonstrate this exploit 0:39-0:47
• The attack can theoretically achieve domain admin compromise in three GET requests, but practical exploitation requires four 0:31-0:35
• The vulnerability hinges on specific circumstances and misconfigurations within the CyberArk PSM environment 0:24-0:30
This presentation serves as a stark warning that even enterprise-grade privileged access management solutions like CyberArk can be catastrophically compromised when not properly configured.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hi everyone. Welcome and thanks for joining my session. And before we start, any CyberArk admins in the room? It's going to be fun. Any CyberArk users in the room? Also good. That's also good. Anyone who doesn't know what CyberArk is? That's also fine. I'm going to cover it anyway. Um well, CyberArk is uh of course it's a very interesting solution and I'm going to actually share some magic with you that under certain circumstances can actually result in three domain admins in just four get requests. Actually, it can also happen in three get requests, but you will know why it actually requires four. Uh so who am I? Uh my name is Marat. I have uh 10 years of experience in offensive security field. I previously worked at uh KPMG, Deloitte, and Unit 42. Now I'm working at uh Falcon Force. Main…