---
id: CVE-2025-4228
title: 'Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability'
summary: >-
  An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex®
  XDR Broker VM allows an authenticated administrative user to execute certain
  files available within the Broker VM and escalate their privileges to root.
severity: medium
cvss: 4.6
cvssVector: >-
  CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber
cvssSource: cna
cwe:
  - CWE-266
vendor: Palo Alto Networks
product: Cortex XDR Broker VM
affected:
  - cortex_xdr_broker_vm >= 27.0.0 < 27.0.26
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-06-14T03:56:20.896226Z'
published: '2025-06-12'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:03:00.976Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-4228'
references:
  - url: 'https://security.paloaltonetworks.com/CVE-2025-4228'
tags:
  - cve.org
epss: 0.00188
epssPercentile: 0.08576
ingestedAt: '2026-11-05T20:33:06.557Z'
---

## Overview

An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.

## Affected

- `cortex_xdr_broker_vm >= 27.0.0 < 27.0.26`

## Remediation

This issue is fixed in Cortex XDR Broker VM 27.0.26, and all later Cortex XDR Broker VM versions.


  *  If you enabled automatic upgrades for Broker VM, then no action is required at this time. 
  *  If you did not enable automatic upgrades, then we recommend that you do so for Broker VM to ensure that you always have the latest security patches installed in your software.

### Workarounds

No known workarounds or mitigations exist for this issue.