CVE-2025-4228Medium· 4.6▾ SunlitAn incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.
cortex_xdr_broker_vm >= 27.0.0 < 27.0.26This issue is fixed in Cortex XDR Broker VM 27.0.26, and all later Cortex XDR Broker VM versions.
No known workarounds or mitigations exist for this issue.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-0304Medium· 4.8A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.
CVE-2025-4234Low· 2.4Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of Credentials
CVE-2026-45165High· 8.6An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch
CVE-2026-0262Medium· 6.6PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing
CVE-2026-0257High· 7.8PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
CVE-2026-0256Medium· 4.4PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface