r/CyberARk

Hi everyone,

We are facing an issue with CyberArk PAM password rotation and would appreciate some guidance.

When PAM rotates an account password while the user still has an active session, the account gets locked out. We are receiving multiple complaints from users because of this behavior.

Our current situation is:

The account is managed by PAM and its password is rotated automatically.

The user has an active session when the password rotation occurs.

After the rotation, the account eventually becomes locked out.

We would like to prevent these lockouts without compromising the password rotation process.

Has anyone encountered this scenario with CyberArk PAM? What is the recommended configuration or best practice to prevent account lockouts when password rotation occurs while an active session exists?

Any advice regarding the interaction between CyberArk password rotation, active sessions, and AD account lockout policy would be appreciated.

I’m posting this because I genuinely need help understanding what is happening with my Freepik/Magnific account, and I want to know if anyone else has experienced this.

A few days ago, my account was compromised.

# What happened

* My account had **2FA enabled**.
* The attacker somehow accessed the account and **disabled 2FA**.
* Approximately **2 million AI credits/tokens were consumed without my authorization**, mainly through video generation.
* I immediately secured the account and used **“Log out of all devices.”**
* However, **video generation continued even after I logged out all devices**.
* I checked for API keys, MCP connections, automations, and other obvious integrations, but couldn't find anything that explained the activity.
* I immediately contacted Freepik/Magnific support and opened a security case.
* I completed their ownership/payment verification and provided everything they requested.
* Their support initially said they were investigating and later told me the case had been **escalated to a manager**.

# The situation is STILL ongoing

This is the part that concerns me the most.

**Even today, after securing the account and while Freepik is supposedly investigating, unauthorized activity appears to still be happening and additional credits/tokens are being consumed.**

I am deliberately **not using the account myself**, because I don't want my legitimate activity to be mixed with the attacker's activity while the investigation is open.

And now, **Freepik/Magnific is not providing any further response either.**

Their last meaningful response was that the case had been escalated to a manager. Since then, I have received no concrete investigation result, no explanation of how the unauthorized access occurred, no timeline for resolution, and no clear answer about how I can safely use my account.

# What I don't understand

If:

* 2FA was enabled,
* 2FA was disabled without my authorization,
* I logged out all devices,
* there is no visible API/MCP/automation explaining the activity,
* I reported the incident immediately,
* the case was escalated to their internal team,

**how can someone still be using the account and consuming credits?**

Could there be a persistent session/token, server-side job queue, OAuth authorization, hidden integration, or another authentication mechanism that isn't visible to the user?

I am especially interested in hearing from people who understand **session management, OAuth, authentication systems, or Freepik/Magnific's AI generation infrastructure**.

I'm not claiming at this point that Freepik itself was breached. I simply want to understand **how this could happen despite 2FA and logging out all devices**, and why the unauthorized usage appears to be continuing.

This is also causing a real business problem for me. I use Freepik professionally, but I'm afraid to use the account because I don't want legitimate usage to later be attributed to the unauthorized activity.

**Freepik/Magnific support case: 01714613**

If anyone has experienced a similar Freepik/Magnific account compromise, especially one where generation continued after logging out all devices, please share your experience.

And if anyone from Freepik/Magnific's security team sees this: **please investigate this urgently. I have already provided all the requested verification and have been waiting for a resolution while the unauthorized usage continues.**

I can provide screenshots and timestamps privately if useful.

Hello
We have Two Accounts that share the same hostname and username and safe. A RedHat

One RedHat is using platform access with SSH (same user) while the other platform uses RDP.

Both inside same group in PVWA. We want SSH account to change the password on the RedHat and give it to RDP account. RDP account does not need to change anything on RedHat , just gets the password from SSH as text in pvwa

The point since both are the same same hostname and username but one uses rdp and unix, we cant have them both change the password in the group, since once one will change it the other will lose it. So shh change, rdp gets it in the pvwa.

I know that I need to do something in the Platfrom, one is ssh and the other rdp but just connect. I'm not sure what exactly I need to touch.

Thank you

How would you onboard the any privileged account that is either protected using MFA and/Or using SAML SSO

We have several applications where to reset the admin’s password, there is an MFA involved - like a code is sent to an email. How do you manage the password on such applications?

I need help with onboarding automation. Currently i have an excel template which the safe owner needs to fill in for teh cyberark team. I have pretty much some basic details like safe name (generated by formula), users, servers, groups. Are there any thing i need to put in the template.

On the other hand i want a life cycle management (including recertifications) also to be in the file to make the team and the safe oner easier. I am not sure how to do it, if anyone has expierence on this one, it would help me a lot.

and regarding automation, i will convert the excel data to csv to help the flow be quicker and the onboarding can be done faster.

If you can tell me how i can actully implement it, it would be a good help for me. Thanks in advance.

Hi,

I'm trying to create a custom .rdp file to connect directly through CyberArk PSM, without going through PVWA.

Direct PSM connection itself is working fine with Windows Local Account, including authentication with my local CyberArk Vault user.

My issue is with a domain account that can be used to connect to multiple target servers.

The account stored in CyberArk looks roughly like this:

Username: admin_domaine_XXX
Address: DOMAINE.NET
Log On To : DOMAINE

In PVWA, when I click Connect, I get a prompt where I can freely enter the actual target address, for example, thanks to Allow User Connections to Other Machines option :

SRV001.DOMAINE.NET

The same domain account can therefore be used against multiple servers.

For a direct PSM RDP connection, CyberArk documentation gives this kind of syntax:

psm /u domainadmin@mycompany.com /a 10.10.2.145 /c PSM-RDP

So I tried the equivalent:

alternate shell:s:psm /u admin_domaine_XXX@DOMAINE.NET /a SRV001.DOMAINE.NET /c PSM-RDP

and

alternate shell:s:psm /u admin_domaine_XXX@DOMAINE /a SRV001.DOMAINE.NET /c PSM-RDP

However, this does not work.

PSM reports that the account cannot be found, and I understand the issue....

The only configuration that successfully finds the account is:

alternate shell:s:psm /u admin_domaine_XXX /a DOMAINE.NET /c PSM-RDP

But obviously, in that case /a contains the Vault account Address and not the actual server I want to connect to, si the connexion just instantly cut because DOMAINE.NET isn't a server..

So my question is:

How does PVWA pass the user entered target address to PSM when using a domain account whose Vault Address is the domain itself?

Is there another PSM parameter that allows me to specify separately:

Vault account identification:
admin_domaine_XXX @ DOMAINE.NET

Actual connection target:
SRV001.DOMAINE.NET

My goal is ultimately to reproduce the PVWA behaviour using a direct .rdp file, ideally while keeping the actual target server dynamic.

Has anyone implemented this successfully with PSM direct connections?

The pvwa at first start well, then whatever I do as xpath it just fails.

The problem is the manual test works without an issue.

after login it gets stuck here

ERROR -> HTMLPageController :: FindElement -> Timeout error. Element '//span[contains(@class,'fi-setting')]' was not found in new page.

ERROR -> HTMLPageController :: FindElement -> Timeout error. Element '//a[.//span[contains(@class,"fi-setting")]]' was not found in new page.

ERROR -> HTMLPageController :: FindElement -> Timeout error. Element '//a[@data-toggle='dropdown' and .//span[contains(@class,'fi-setting')]]' was not found in new page.

ERROR -> HTMLPageController :: FindElement -> Timeout error. Element '//*[@id="navigation"]/div/div[1]/div[2]/div[2]/ul/li[8]' was not found in new page.

and every single one of the above works fine with a manual test.

CANetPluginInvoker.exe user.ini ChangepassCyberArk.Extensions.Plugin.WebApp.dll True

The platform is webapp and already copied from a working one. Already tried playing with timeout and why not.

Even if I put something before the above commands the PVWA will go on until it hit those above, while manual test will work with no problem.

Already did Get-ChildItem -Recurse | Unblock-File

Thank you

I'm curious to hear from those who have upgraded their CyberArk On-Prem environment from v14.0 to v14.6.

For those who have gone through the upgrade, what were the most common issues or challenges you encountered? Were there any unexpected compatibility, configuration, or post-upgrade issues that required additional troubleshooting?

I'm also interested in understanding the approach to hardening scripts. Do you typically re-run the CyberArk hardening scripts when upgrading within the same major version (e.g., 14.0 → 14.6), or do you only apply them during fresh installations or major upgrade (e.g., 12.6 → 14.6)?

Nowadays, we have lots of conversations going on AI integration in every org. how many of you are benefiting doing any amounts of integration in your Idira environment? have you implemented. AI integration idira’s environment? and how are you benefiting? if not how can we benefit integrating it?

Morning folks,

SELF HOSTED V14.2

Just looking for some help to sense check a plan please. I'm working for a company with an old and badly installed Cyberark environment.

They have a Primary host (V11) which keeps failing at an OS level and they can't fix it. The previous DR (V2)is now maintained as Primary but still, V1 has OS issues and falls over now and again.

They don't have a pre prod to test

They have spun up a new OS to become the new DR (V3)

Their licence restricts them to a single DR user so I've suggested the following.

1)Stop V1 DR services

2)Try and install DR on V3 with the OG Cyberark password we all know and love, just in case.

3)If that fails then reset the DR password on the Primary

4)Install using that

5)Perform full replication to V3 from V2

6)Reconfigure all components vault.ini

I can't think of any potential issues with that except with a rollback. If we needed to rollback to having V1 as the DR, there's nothing more to do than go through CreatCred process with the new password?

Any risk to data?