CVE-2025-4234Low· 2.4▾ SunlitA problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generati…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.
cortex_xdr_microsoft_365_defender_pack >= 4.6.0 < 11.0.2-133Version Minor Version Suggested Solution
Cortex XDR Microsoft 365 Defender Pack 4.6 on Windows
4.6.0 through 4.6.4
Upgrade to 4.6.5 or later.
Rotate any Client Secrets for Azure Applications that attempted connection with the Microsoft 365 Defender Pack.
No known workarounds exist for this issue.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-4228Medium· 4.6Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
CVE-2026-45165High· 8.6An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch
CVE-2026-0262Medium· 6.6PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing
CVE-2026-0257High· 7.8PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
CVE-2026-0256Medium· 4.4PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
CVE-2026-0265High· 7.2PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled