{"id":"CVE-2025-4228","title":"Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability","summary":"An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.","severity":"medium","cvss":4.6,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber","cvssSource":"cna","cwe":["CWE-266"],"vendor":"Palo Alto Networks","product":"Cortex XDR Broker VM","affected":["cortex_xdr_broker_vm >= 27.0.0 < 27.0.26"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-06-14T03:56:20.896226Z"},"published":"2025-06-12","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:03:00.976Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-4228","references":[{"url":"https://security.paloaltonetworks.com/CVE-2025-4228"}],"tags":["cve.org"],"epss":0.00188,"epssPercentile":0.08576,"ingestedAt":"2026-11-05T20:33:06.557Z","slug":"CVE-2025-4228","body":"## Overview\n\nAn incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.\n\n## Affected\n\n- `cortex_xdr_broker_vm >= 27.0.0 < 27.0.26`\n\n## Remediation\n\nThis issue is fixed in Cortex XDR Broker VM 27.0.26, and all later Cortex XDR Broker VM versions.\n\n\n  *  If you enabled automatic upgrades for Broker VM, then no action is required at this time. \n  *  If you did not enable automatic upgrades, then we recommend that you do so for Broker VM to ensure that you always have the latest security patches installed in your software.\n\n### Workarounds\n\nNo known workarounds or mitigations exist for this issue.","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":25.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}