Vulnerability-Lookup

CVE-2025-0134 (GCVE-0-2025-0134)

Vulnerability from cvelistv5 – Published: 2025-05-14 18:07 – Updated: 2026-02-26 18:28

Title

Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM

Summary

A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM.

Severity

6.5 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-15 04:02 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

palo_alto CNA under the mitre root

CNA scorecard A 95/100 over 96 records in the last 180 days details

References

1 reference

URL	Tags
https://security.paloaltonetworks.com/CVE-2025-0134	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Palo Alto Networks	Cortex XDR Broker VM	Affected: 26.0.0 , < 26.0.119 (custom) cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.10:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.3:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.119:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.116:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.100.4:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.0.44:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.100.4:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.4.7:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.2.8:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.5.1:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.100.2:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.35:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.33:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.35:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.32:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:21.5.4:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:20.9.1:::::::*

Date Public

2025-05-14 16:00

Credits

Christiaan van Aken

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0134",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-15T04:02:10.628623Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T18:28:08.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.119:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.116:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.100.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.0.44:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.100.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.5.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.100.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.35:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.33:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.35:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.32:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:21.5.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:20.9.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Cortex XDR Broker VM",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "26.0.119",
                  "status": "unaffected"
                }
              ],
              "lessThan": "26.0.119",
              "status": "affected",
              "version": "26.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "No special configuration is required to be affected by this issue."
            }
          ],
          "value": "No special configuration is required to be affected by this issue."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christiaan van Aken"
        }
      ],
      "datePublic": "2025-05-14T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A code injection vulnerability in the Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM."
            }
          ],
          "value": "A code injection vulnerability in the Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "USER",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-14T18:07:54.706Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2025-0134"
        }
      ],
      "solutions": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue is fixed in Cortex XDR Broker VM 26.0.119, and all later Cortex XDR Broker VM versions. \u003cbr\u003e\u003cul\u003e\u003cli\u003eIf you enabled automatic upgrades for Broker VM, then no action is required at this time.\u003c/li\u003e\u003cli\u003eIf you did not enable automatic upgrades, then we recommend you do so for Broker VM to ensure that you always have the latest security patches installed in your software.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "This issue is fixed in Cortex XDR Broker VM 26.0.119, and all later Cortex XDR Broker VM versions. \n  *  If you enabled automatic upgrades for Broker VM, then no action is required at this time.\n  *  If you did not enable automatic upgrades, then we recommend you do so for Broker VM to ensure that you always have the latest security patches installed in your software."
        }
      ],
      "source": {
        "defect": [
          "CRTX-105741"
        ],
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-05-14T16:00:00.000Z",
          "value": "Initial Publication"
        }
      ],
      "title": "Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There are no known workarounds or mitigations for this issue."
            }
          ],
          "value": "There are no known workarounds or mitigations for this issue."
        }
      ],
      "x_affectedList": [
        "Cortex XDR Broker VM 26.0.0",
        "Cortex XDR Broker VM 26.0.1",
        "Cortex XDR Broker VM 26.0.2",
        "Cortex XDR Broker VM 26.0.3",
        "Cortex XDR Broker VM 26.0.4",
        "Cortex XDR Broker VM 26.0.5",
        "Cortex XDR Broker VM 26.0.6",
        "Cortex XDR Broker VM 26.0.7",
        "Cortex XDR Broker VM 26.0.8",
        "Cortex XDR Broker VM 26.0.9",
        "Cortex XDR Broker VM 26.0.10",
        "Cortex XDR Broker VM 26.0.11",
        "Cortex XDR Broker VM 26.0.12",
        "Cortex XDR Broker VM 26.0.13",
        "Cortex XDR Broker VM 26.0.14",
        "Cortex XDR Broker VM 26.0.15",
        "Cortex XDR Broker VM 26.0.16",
        "Cortex XDR Broker VM 26.0.17",
        "Cortex XDR Broker VM 26.0.18",
        "Cortex XDR Broker VM 26.0.19",
        "Cortex XDR Broker VM 26.0.20",
        "Cortex XDR Broker VM 26.0.21",
        "Cortex XDR Broker VM 26.0.22",
        "Cortex XDR Broker VM 26.0.23",
        "Cortex XDR Broker VM 26.0.24",
        "Cortex XDR Broker VM 26.0.25",
        "Cortex XDR Broker VM 26.0.26",
        "Cortex XDR Broker VM 26.0.27",
        "Cortex XDR Broker VM 26.0.28",
        "Cortex XDR Broker VM 26.0.29",
        "Cortex XDR Broker VM 26.0.30",
        "Cortex XDR Broker VM 26.0.31",
        "Cortex XDR Broker VM 26.0.32",
        "Cortex XDR Broker VM 26.0.33",
        "Cortex XDR Broker VM 26.0.34",
        "Cortex XDR Broker VM 26.0.35",
        "Cortex XDR Broker VM 26.0.36",
        "Cortex XDR Broker VM 26.0.37",
        "Cortex XDR Broker VM 26.0.38",
        "Cortex XDR Broker VM 26.0.39",
        "Cortex XDR Broker VM 26.0.40",
        "Cortex XDR Broker VM 26.0.41",
        "Cortex XDR Broker VM 26.0.42",
        "Cortex XDR Broker VM 26.0.43",
        "Cortex XDR Broker VM 26.0.44",
        "Cortex XDR Broker VM 26.0.45",
        "Cortex XDR Broker VM 26.0.46",
        "Cortex XDR Broker VM 26.0.47",
        "Cortex XDR Broker VM 26.0.48",
        "Cortex XDR Broker VM 26.0.49",
        "Cortex XDR Broker VM 26.0.50",
        "Cortex XDR Broker VM 26.0.51",
        "Cortex XDR Broker VM 26.0.52",
        "Cortex XDR Broker VM 26.0.53",
        "Cortex XDR Broker VM 26.0.54",
        "Cortex XDR Broker VM 26.0.55",
        "Cortex XDR Broker VM 26.0.56",
        "Cortex XDR Broker VM 26.0.57",
        "Cortex XDR Broker VM 26.0.58",
        "Cortex XDR Broker VM 26.0.59",
        "Cortex XDR Broker VM 26.0.60",
        "Cortex XDR Broker VM 26.0.61",
        "Cortex XDR Broker VM 26.0.62",
        "Cortex XDR Broker VM 26.0.63",
        "Cortex XDR Broker VM 26.0.64",
        "Cortex XDR Broker VM 26.0.65",
        "Cortex XDR Broker VM 26.0.66",
        "Cortex XDR Broker VM 26.0.67",
        "Cortex XDR Broker VM 26.0.68",
        "Cortex XDR Broker VM 26.0.69",
        "Cortex XDR Broker VM 26.0.70",
        "Cortex XDR Broker VM 26.0.71",
        "Cortex XDR Broker VM 26.0.72",
        "Cortex XDR Broker VM 26.0.73",
        "Cortex XDR Broker VM 26.0.74",
        "Cortex XDR Broker VM 26.0.75",
        "Cortex XDR Broker VM 26.0.76",
        "Cortex XDR Broker VM 26.0.77",
        "Cortex XDR Broker VM 26.0.78",
        "Cortex XDR Broker VM 26.0.79",
        "Cortex XDR Broker VM 26.0.80",
        "Cortex XDR Broker VM 26.0.81",
        "Cortex XDR Broker VM 26.0.82",
        "Cortex XDR Broker VM 26.0.83",
        "Cortex XDR Broker VM 26.0.84",
        "Cortex XDR Broker VM 26.0.85",
        "Cortex XDR Broker VM 26.0.86",
        "Cortex XDR Broker VM 26.0.87",
        "Cortex XDR Broker VM 26.0.88",
        "Cortex XDR Broker VM 26.0.89",
        "Cortex XDR Broker VM 26.0.90",
        "Cortex XDR Broker VM 26.0.91",
        "Cortex XDR Broker VM 26.0.92",
        "Cortex XDR Broker VM 26.0.93",
        "Cortex XDR Broker VM 26.0.94",
        "Cortex XDR Broker VM 26.0.95",
        "Cortex XDR Broker VM 26.0.96",
        "Cortex XDR Broker VM 26.0.97",
        "Cortex XDR Broker VM 26.0.98",
        "Cortex XDR Broker VM 26.0.99",
        "Cortex XDR Broker VM 26.0.100",
        "Cortex XDR Broker VM 26.0.101",
        "Cortex XDR Broker VM 26.0.102",
        "Cortex XDR Broker VM 26.0.103",
        "Cortex XDR Broker VM 26.0.104",
        "Cortex XDR Broker VM 26.0.105",
        "Cortex XDR Broker VM 26.0.106",
        "Cortex XDR Broker VM 26.0.107",
        "Cortex XDR Broker VM 26.0.108",
        "Cortex XDR Broker VM 26.0.109",
        "Cortex XDR Broker VM 26.0.110",
        "Cortex XDR Broker VM 26.0.111",
        "Cortex XDR Broker VM 26.0.112",
        "Cortex XDR Broker VM 26.0.113",
        "Cortex XDR Broker VM 26.0.114",
        "Cortex XDR Broker VM 26.0.115",
        "Cortex XDR Broker VM 26.0.116",
        "Cortex XDR Broker VM 26.0.117",
        "Cortex XDR Broker VM 26.0.118"
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2025-0134",
    "datePublished": "2025-05-14T18:07:54.706Z",
    "dateReserved": "2024-12-20T23:23:34.744Z",
    "dateUpdated": "2026-02-26T18:28:08.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-0134",
      "date": "2026-11-01",
      "epss": "0.0053",
      "percentile": "0.44868"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.10:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.119:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.116:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.100.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.0.44:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.100.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.4.7:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.2.8:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.5.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.100.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.35:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.33:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.35:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.32:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:21.5.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:20.9.1:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "Cortex XDR Broker VM",
                "vendor": "Palo Alto Networks",
                "versions": [
                  {
                    "changes": [
                      {
                        "at": "26.0.119",
                        "status": "unaffected"
                      }
                    ],
                    "lessThan": "26.0.119",
                    "status": "affected",
                    "version": "26.0.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "psirt@paloaltonetworks.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A code injection vulnerability in the Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de inyecci\u00f3n de c\u00f3digo en Palo Alto Networks Cortex XDR\u00ae Broker VM permite que un usuario autenticado ejecute c\u00f3digo arbitrario con privilegios de root en el sistema operativo host que ejecuta Broker VM."
          }
        ],
        "id": "CVE-2025-0134",
        "lastModified": "2026-06-17T08:25:56.290",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NO",
                "Recovery": "USER",
                "Safety": "NEGLIGIBLE",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "AMBER",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "CONCENTRATED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:M/U:Amber",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "source": "psirt@paloaltonetworks.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-0134",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-15T04:02:10.628623Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-05-14T19:15:51.677",
        "references": [
          {
            "source": "psirt@paloaltonetworks.com",
            "url": "https://security.paloaltonetworks.com/CVE-2025-0134"
          }
        ],
        "sourceIdentifier": "psirt@paloaltonetworks.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-94"
              }
            ],
            "source": "psirt@paloaltonetworks.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T09:19:51+00:00",
      "cve": "CVE-2025-0134",
      "id": "CVE-2025-0134",
      "initial_release_date": "2025-05-14T16:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-0134.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-0134",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-05-15T04:02:10.628623Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-05-14T20:50:42.920Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.10:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.119:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.116:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.100.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.0.44:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.100.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.4.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.2.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.5.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.100.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.35:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.33:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.35:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.32:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:21.5.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:20.9.1:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "Cortex XDR Broker VM",
              "vendor": "Palo Alto Networks",
              "versions": [
                {
                  "changes": [
                    {
                      "at": "26.0.119",
                      "status": "unaffected"
                    }
                  ],
                  "lessThan": "26.0.119",
                  "status": "affected",
                  "version": "26.0.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "No special configuration is required to be affected by this issue."
                }
              ],
              "value": "No special configuration is required to be affected by this issue."
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Christiaan van Aken"
            }
          ],
          "datePublic": "2025-05-14T16:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A code injection vulnerability in the Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM."
                }
              ],
              "value": "A code injection vulnerability in the Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
                }
              ],
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-242",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-242 Code Injection"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NO",
                "Recovery": "USER",
                "Safety": "NEGLIGIBLE",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "LOW",
                "providerUrgency": "AMBER",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "CONCENTRATED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-94",
                  "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-14T18:07:54.706Z",
            "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
            "shortName": "palo_alto"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://security.paloaltonetworks.com/CVE-2025-0134"
            }
          ],
          "solutions": [
            {
              "lang": "eng",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "This issue is fixed in Cortex XDR Broker VM 26.0.119, and all later Cortex XDR Broker VM versions. \u003cbr\u003e\u003cul\u003e\u003cli\u003eIf you enabled automatic upgrades for Broker VM, then no action is required at this time.\u003c/li\u003e\u003cli\u003eIf you did not enable automatic upgrades, then we recommend you do so for Broker VM to ensure that you always have the latest security patches installed in your software.\u003c/li\u003e\u003c/ul\u003e"
                }
              ],
              "value": "This issue is fixed in Cortex XDR Broker VM 26.0.119, and all later Cortex XDR Broker VM versions. \n  *  If you enabled automatic upgrades for Broker VM, then no action is required at this time.\n  *  If you did not enable automatic upgrades, then we recommend you do so for Broker VM to ensure that you always have the latest security patches installed in your software."
            }
          ],
          "source": {
            "defect": [
              "CRTX-105741"
            ],
            "discovery": "UNKNOWN"
          },
          "timeline": [
            {
              "lang": "en",
              "time": "2025-05-14T16:00:00.000Z",
              "value": "Initial Publication"
            }
          ],
          "title": "Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "There are no known workarounds or mitigations for this issue."
                }
              ],
              "value": "There are no known workarounds or mitigations for this issue."
            }
          ],
          "x_affectedList": [
            "Cortex XDR Broker VM 26.0.0",
            "Cortex XDR Broker VM 26.0.1",
            "Cortex XDR Broker VM 26.0.2",
            "Cortex XDR Broker VM 26.0.3",
            "Cortex XDR Broker VM 26.0.4",
            "Cortex XDR Broker VM 26.0.5",
            "Cortex XDR Broker VM 26.0.6",
            "Cortex XDR Broker VM 26.0.7",
            "Cortex XDR Broker VM 26.0.8",
            "Cortex XDR Broker VM 26.0.9",
            "Cortex XDR Broker VM 26.0.10",
            "Cortex XDR Broker VM 26.0.11",
            "Cortex XDR Broker VM 26.0.12",
            "Cortex XDR Broker VM 26.0.13",
            "Cortex XDR Broker VM 26.0.14",
            "Cortex XDR Broker VM 26.0.15",
            "Cortex XDR Broker VM 26.0.16",
            "Cortex XDR Broker VM 26.0.17",
            "Cortex XDR Broker VM 26.0.18",
            "Cortex XDR Broker VM 26.0.19",
            "Cortex XDR Broker VM 26.0.20",
            "Cortex XDR Broker VM 26.0.21",
            "Cortex XDR Broker VM 26.0.22",
            "Cortex XDR Broker VM 26.0.23",
            "Cortex XDR Broker VM 26.0.24",
            "Cortex XDR Broker VM 26.0.25",
            "Cortex XDR Broker VM 26.0.26",
            "Cortex XDR Broker VM 26.0.27",
            "Cortex XDR Broker VM 26.0.28",
            "Cortex XDR Broker VM 26.0.29",
            "Cortex XDR Broker VM 26.0.30",
            "Cortex XDR Broker VM 26.0.31",
            "Cortex XDR Broker VM 26.0.32",
            "Cortex XDR Broker VM 26.0.33",
            "Cortex XDR Broker VM 26.0.34",
            "Cortex XDR Broker VM 26.0.35",
            "Cortex XDR Broker VM 26.0.36",
            "Cortex XDR Broker VM 26.0.37",
            "Cortex XDR Broker VM 26.0.38",
            "Cortex XDR Broker VM 26.0.39",
            "Cortex XDR Broker VM 26.0.40",
            "Cortex XDR Broker VM 26.0.41",
            "Cortex XDR Broker VM 26.0.42",
            "Cortex XDR Broker VM 26.0.43",
            "Cortex XDR Broker VM 26.0.44",
            "Cortex XDR Broker VM 26.0.45",
            "Cortex XDR Broker VM 26.0.46",
            "Cortex XDR Broker VM 26.0.47",
            "Cortex XDR Broker VM 26.0.48",
            "Cortex XDR Broker VM 26.0.49",
            "Cortex XDR Broker VM 26.0.50",
            "Cortex XDR Broker VM 26.0.51",
            "Cortex XDR Broker VM 26.0.52",
            "Cortex XDR Broker VM 26.0.53",
            "Cortex XDR Broker VM 26.0.54",
            "Cortex XDR Broker VM 26.0.55",
            "Cortex XDR Broker VM 26.0.56",
            "Cortex XDR Broker VM 26.0.57",
            "Cortex XDR Broker VM 26.0.58",
            "Cortex XDR Broker VM 26.0.59",
            "Cortex XDR Broker VM 26.0.60",
            "Cortex XDR Broker VM 26.0.61",
            "Cortex XDR Broker VM 26.0.62",
            "Cortex XDR Broker VM 26.0.63",
            "Cortex XDR Broker VM 26.0.64",
            "Cortex XDR Broker VM 26.0.65",
            "Cortex XDR Broker VM 26.0.66",
            "Cortex XDR Broker VM 26.0.67",
            "Cortex XDR Broker VM 26.0.68",
            "Cortex XDR Broker VM 26.0.69",
            "Cortex XDR Broker VM 26.0.70",
            "Cortex XDR Broker VM 26.0.71",
            "Cortex XDR Broker VM 26.0.72",
            "Cortex XDR Broker VM 26.0.73",
            "Cortex XDR Broker VM 26.0.74",
            "Cortex XDR Broker VM 26.0.75",
            "Cortex XDR Broker VM 26.0.76",
            "Cortex XDR Broker VM 26.0.77",
            "Cortex XDR Broker VM 26.0.78",
            "Cortex XDR Broker VM 26.0.79",
            "Cortex XDR Broker VM 26.0.80",
            "Cortex XDR Broker VM 26.0.81",
            "Cortex XDR Broker VM 26.0.82",
            "Cortex XDR Broker VM 26.0.83",
            "Cortex XDR Broker VM 26.0.84",
            "Cortex XDR Broker VM 26.0.85",
            "Cortex XDR Broker VM 26.0.86",
            "Cortex XDR Broker VM 26.0.87",
            "Cortex XDR Broker VM 26.0.88",
            "Cortex XDR Broker VM 26.0.89",
            "Cortex XDR Broker VM 26.0.90",
            "Cortex XDR Broker VM 26.0.91",
            "Cortex XDR Broker VM 26.0.92",
            "Cortex XDR Broker VM 26.0.93",
            "Cortex XDR Broker VM 26.0.94",
            "Cortex XDR Broker VM 26.0.95",
            "Cortex XDR Broker VM 26.0.96",
            "Cortex XDR Broker VM 26.0.97",
            "Cortex XDR Broker VM 26.0.98",
            "Cortex XDR Broker VM 26.0.99",
            "Cortex XDR Broker VM 26.0.100",
            "Cortex XDR Broker VM 26.0.101",
            "Cortex XDR Broker VM 26.0.102",
            "Cortex XDR Broker VM 26.0.103",
            "Cortex XDR Broker VM 26.0.104",
            "Cortex XDR Broker VM 26.0.105",
            "Cortex XDR Broker VM 26.0.106",
            "Cortex XDR Broker VM 26.0.107",
            "Cortex XDR Broker VM 26.0.108",
            "Cortex XDR Broker VM 26.0.109",
            "Cortex XDR Broker VM 26.0.110",
            "Cortex XDR Broker VM 26.0.111",
            "Cortex XDR Broker VM 26.0.112",
            "Cortex XDR Broker VM 26.0.113",
            "Cortex XDR Broker VM 26.0.114",
            "Cortex XDR Broker VM 26.0.115",
            "Cortex XDR Broker VM 26.0.116",
            "Cortex XDR Broker VM 26.0.117",
            "Cortex XDR Broker VM 26.0.118"
          ],
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "assignerShortName": "palo_alto",
        "cveId": "CVE-2025-0134",
        "datePublished": "2025-05-14T18:07:54.706Z",
        "dateReserved": "2024-12-20T23:23:34.744Z",
        "dateUpdated": "2026-02-26T18:28:08.148Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2025-05726 (CVE-2025-0134)

Vulnerability from fstec – Published: 2025-05-21 – Updated: 2025-08-13 – View on bdu.fstec.ru Fixed

Title

Уязвимость брокера Broker VM платформы безопасности Cortex XDR, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код

Summary

Уязвимость брокера Broker VM платформы безопасности Cortex XDR связана с неверным управлением генерацией кода. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код

Severity

6.5 (Medium) CVSS 2.0


                      
                        AV:N/AC:L/Au:S/C:P/I:P/A:P

7.4 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

6.5 (Medium) CVSS 4.0


                      
                        CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Injection

Incidents

Being clarified

Remediation

Software update

CWE

CWE-94 - Неверное управление генерацией кода (Внедрение кода)

Aliases

CVE-2025-0134

References

1 reference

URL
https://security.paloaltonetworks.com/CVE-2025-0134

Impacted products

1 product from 1 vendor

Vendors

Palo Alto Networks Inc.

Products

Broker VM

Versions

от 26.0.0 до 26.0.119 (Broker VM)

Product types

Virtualization software

Mitigations

Использование рекомендаций: https://security.paloaltonetworks.com/CVE-2025-0134

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
  "CVSS 4.0": "AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber",
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Palo Alto Networks Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 26.0.0 \u0434\u043e 26.0.119 (Broker VM)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://security.paloaltonetworks.com/CVE-2025-0134",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "14.05.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "13.08.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "21.05.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-05726",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-0134",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Broker VM",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0440\u043e\u043a\u0435\u0440\u0430 Broker VM \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Cortex XDR, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430 (\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430) (CWE-94)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0440\u043e\u043a\u0435\u0440\u0430 Broker VM \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Cortex XDR \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://security.paloaltonetworks.com/CVE-2025-0134",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438/\u041f\u041e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-94",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,5)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,4)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 4.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,5)"
}

CERTFR-2025-AVI-0410

Vulnerability from certfr_avis - Published: 2025-05-15 - Updated: 2025-05-15

De multiples vulnérabilités ont été découvertes dans les produits Palo Alto Networks. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Les versions correctives pour la vulnérabilité CVE-2025-0133 sont prévus pour juin (PAN-OS 11.2.8), juillet (PAN-OS 11.1.11) et août 2025 (PAN-OS 10.2.17)

Impacted products

Vendor	Product	Description
Palo Alto Networks	GlobalProtect App	GlobalProtect App versions antérieures à 6.0.0 sans les derniers correctifs de sécurité
Palo Alto Networks	PAN-OS	PAN-OS versions 11.2.x antérieures à 11.2.5
Palo Alto Networks	GlobalProtect App	GlobalProtect App versions antérieures à 6.1.0 sans les derniers correctifs de sécurité
Palo Alto Networks	N/A	MetaDefender Endpoint Security versions antérieures à 4.3.4451 sur Windows
Palo Alto Networks	PAN-OS	PAN-OS versions antérieures à 10.1.14-h14
Palo Alto Networks	PAN-OS	PAN-OS versions 10.2.x antérieures à 10.2.13
Palo Alto Networks	Prisma Cloud Compute	Prisma Cloud Compute Edition versions antérieures à 34.00.141
Palo Alto Networks	Prisma Access	Prisma Access Browser versions antérieures à 136.11.9.93
Palo Alto Networks	PAN-OS	PAN-OS versions 11.0.x antérieures à 11.0.7
Palo Alto Networks	Cortex XDR Broker	Cortex XDR Broker VM versions antérieures à 26.0.119
Palo Alto Networks	PAN-OS	PAN-OS versions 11.1.x antérieures à 11.1.8
Palo Alto Networks	GlobalProtect App	GlobalProtect App versions 6.2.x antérieures à 6.2.8 sur macOS
Palo Alto Networks	GlobalProtect App	GlobalProtect App versions 6.3.x antérieures à 6.3.3 sur macOS

References

Title

Publication Time

FKIE_CVE-2025-0134

Vulnerability from fkie_nvd - Published: 2025-05-14 19:15 - Updated: 2026-06-17 08:25

Severity

6.5 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber

Summary

References

	URL	Tags
	psirt@paloaltonetworks.com	https://security.paloaltonetworks.com/CVE-2025-0134

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.119:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.116:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.100.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.0.44:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.100.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.5.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.100.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.35:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.33:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.35:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.32:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:21.5.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:20.9.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Cortex XDR Broker VM",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "26.0.119",
                  "status": "unaffected"
                }
              ],
              "lessThan": "26.0.119",
              "status": "affected",
              "version": "26.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@paloaltonetworks.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A code injection vulnerability in the Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyecci\u00f3n de c\u00f3digo en Palo Alto Networks Cortex XDR\u00ae Broker VM permite que un usuario autenticado ejecute c\u00f3digo arbitrario con privilegios de root en el sistema operativo host que ejecuta Broker VM."
    }
  ],
  "id": "CVE-2025-0134",
  "lastModified": "2026-06-17T08:25:56.290",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NO",
          "Recovery": "USER",
          "Safety": "NEGLIGIBLE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "AMBER",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:M/U:Amber",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "MODERATE"
        },
        "source": "psirt@paloaltonetworks.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-0134",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-05-15T04:02:10.628623Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-05-14T19:15:51.677",
  "references": [
    {
      "source": "psirt@paloaltonetworks.com",
      "url": "https://security.paloaltonetworks.com/CVE-2025-0134"
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "psirt@paloaltonetworks.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GHVV-MG26-G3C9

Vulnerability from github – Published: 2025-05-14 21:31 – Updated: 2025-05-14 21:31

Details

Severity

6.5 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-0134"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-14T19:15:51Z",
    "severity": "MODERATE"
  },
  "details": "A code injection vulnerability in the Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM.",
  "id": "GHSA-ghvv-mg26-g3c9",
  "modified": "2025-05-14T21:31:18Z",
  "published": "2025-05-14T21:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0134"
    },
    {
      "type": "WEB",
      "url": "https://security.paloaltonetworks.com/CVE-2025-0134"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:M/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-0134 (GCVE-0-2025-0134)

BDU:2025-05726 (CVE-2025-0134)

CERTFR-2025-AVI-0410

Solutions

FKIE_CVE-2025-0134

GHSA-GHVV-MG26-G3C9

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour