Palo Alto Networks Cortex XDR Broker VM Privilege Escalation (CVE-2026-0304)

Key Vulnerability Information Summary Vulnerability Overview Vulnerability ID: CVE-2026-0304 Vulnerability Name: Cortex XDR Broker VM Privilege Escalation Vulnerability Vulnerability Type: Privilege Escalation Affected Component: Palo Alto Networks Cortex XDR Broker VM Description: This vulnerability allows an authenticated, low-privileged user to execute code with root privileges on the Broker VM via a man-in-the-middle (MitM) attack. Severity: MEDIUM (CVSS v3.1 Score 4.8) Urgency: MODERATE Attack Vector: ADJACENT (Adjacent Network) Attack Complexity: LOW Privileges Required: LOW (Low-privileged user) User Interaction: NONE Impact: High impact on confidentiality, integrity, and availability (HIGH) Weakness Types: - CWE-88: Inadequately Neutralized Parameters in Command Injection - CAPEC-126: Path Traversal Scope of Impact CPE Applicability: is vulnerable within the version range [32.0, 32.0.52). Configuration Requirements: Brokers handling cloud delivery mount actions are susceptible without any special configuration. Fix The vulnerability is fixed in Cortex XDR Broker VM 32.0.52 and later versions. If automatic updates are enabled: No further action is required. If automatic updates are not enabled: It is recommended to manually enable automatic updates to ensure that the latest security patches are always installed. Additional Information Exploitation Status: Palo Alto Networks is not currently aware of any malicious exploitation of this vulnerability. Interim Mitigations: No known mitigations are available at this time. Timeline: Initially published on 2026-09-10. Discovery Method: Discovered and reported by the internal security research team. POC / Exploit Code The page does not include POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

Palo Alto Networks Cortex XDR Broker VM Privilege Escalation (CVE-2026-0304)

More from this source