The password upload utility must run from the CPM (Central Policy Manager) server because it is designed to integrate with the CPM services to securely upload and manage password data. The CPM server is equipped with the necessary infrastructure and permissions to handle this task securely, ensuring that passwords are managed in compliance with organizational security policies.