Vulnerability-Lookup

CVE-2026-0231 (GCVE-0-2026-0231)

Vulnerability from cvelistv5 – Published: 2026-03-11 18:03 – Updated: 2026-03-11 20:21

Title

Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability

Summary

An information disclosure vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to obtain and modify sensitive information by triggering live terminal session via Cortex UI and modifying any configuration setting. The attacker must have network access to the Broker VM to exploit this issue.

Severity

5.7 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-11 20:21 UTC

CWE

CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

Assigner

palo_alto CNA under the mitre root

CNA scorecard A 95/100 over 78 records in the last 180 days details

References

1 reference

URL	Tags
https://security.paloaltonetworks.com/CVE-2026-0231	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Palo Alto Networks	Cortex XDR Broker VM	Affected: 30.0.0 , < 30.0.49 (custom) cpe:2.3:a:palo_alto_networks:cortex_xdr_broker_vm::::::::

Date Public

2026-03-11 16:00

Credits

an internal reporter, Nicola Kalak,

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0231",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-11T20:21:23.660381Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-11T20:21:35.933Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Cortex XDR Broker VM",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "30.0.49",
                  "status": "unaffected"
                }
              ],
              "lessThan": "30.0.49",
              "status": "affected",
              "version": "30.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "No special configuration is required to be affected by this issue."
            }
          ],
          "value": "No special configuration is required to be affected by this issue."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:palo_alto_networks:cortex_xdr_broker_vm:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "30.0.49",
                  "versionStartIncluding": "30.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "an internal reporter, Nicola Kalak,"
        }
      ],
      "datePublic": "2026-03-11T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An information disclosure vulnerability in\u0026nbsp;Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to obtain and modify sensitive information by triggering live terminal session via Cortex UI \u003cspan\u003eand modifying any configuration setting\u003c/span\u003e.\u0026nbsp;\u003cbr\u003e\u003cp\u003eThe attacker must have network access to the Broker VM to exploit this issue.\u003c/p\u003e"
            }
          ],
          "value": "An information disclosure vulnerability in\u00a0Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to obtain and modify sensitive information by triggering live terminal session via Cortex UI and modifying any configuration setting.\u00a0\nThe attacker must have network access to the Broker VM to exploit this issue."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-497",
              "description": "CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-11T18:03:21.302Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2026-0231"
        }
      ],
      "solutions": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan\u003eThis issue is fixed in Cortex XDR Broker VM  30.0.49, and all later Cortex XDR Broker VM versions.\u003c/span\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan\u003eIf automatic upgrades are enabled for Broker VM, then no action is required at this time.\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan\u003eIf automatic upgrades are not enabled for Broker VM, then we recommend that you do so to ensure that you always have the latest security patches installed in your software.\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "This issue is fixed in Cortex XDR Broker VM 30.0.49, and all later Cortex XDR Broker VM versions.\n\n * If automatic upgrades are enabled for Broker VM, then no action is required at this time.\n\n * If automatic upgrades are not enabled for Broker VM, then we recommend that you do so to ensure that you always have the latest security patches installed in your software."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-11T16:00:00.000Z",
          "value": "Initial Publication"
        }
      ],
      "title": "Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability",
      "workarounds": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "No known workarounds exist for this issue."
            }
          ],
          "value": "No known workarounds exist for this issue."
        }
      ],
      "x_affectedList": [
        "Cortex XDR Broker VM 30.0.0",
        "Cortex XDR Broker VM 30.0.1",
        "Cortex XDR Broker VM 30.0.2",
        "Cortex XDR Broker VM 30.0.3",
        "Cortex XDR Broker VM 30.0.4",
        "Cortex XDR Broker VM 30.0.5",
        "Cortex XDR Broker VM 30.0.6",
        "Cortex XDR Broker VM 30.0.7",
        "Cortex XDR Broker VM 30.0.8",
        "Cortex XDR Broker VM 30.0.9",
        "Cortex XDR Broker VM 30.0.10",
        "Cortex XDR Broker VM 30.0.11",
        "Cortex XDR Broker VM 30.0.12",
        "Cortex XDR Broker VM 30.0.13",
        "Cortex XDR Broker VM 30.0.14",
        "Cortex XDR Broker VM 30.0.15",
        "Cortex XDR Broker VM 30.0.16",
        "Cortex XDR Broker VM 30.0.17",
        "Cortex XDR Broker VM 30.0.18",
        "Cortex XDR Broker VM 30.0.19",
        "Cortex XDR Broker VM 30.0.20",
        "Cortex XDR Broker VM 30.0.21",
        "Cortex XDR Broker VM 30.0.22",
        "Cortex XDR Broker VM 30.0.23",
        "Cortex XDR Broker VM 30.0.24",
        "Cortex XDR Broker VM 30.0.25",
        "Cortex XDR Broker VM 30.0.26",
        "Cortex XDR Broker VM 30.0.27",
        "Cortex XDR Broker VM 30.0.28",
        "Cortex XDR Broker VM 30.0.29",
        "Cortex XDR Broker VM 30.0.30",
        "Cortex XDR Broker VM 30.0.31",
        "Cortex XDR Broker VM 30.0.32",
        "Cortex XDR Broker VM 30.0.33",
        "Cortex XDR Broker VM 30.0.34",
        "Cortex XDR Broker VM 30.0.35",
        "Cortex XDR Broker VM 30.0.36",
        "Cortex XDR Broker VM 30.0.37",
        "Cortex XDR Broker VM 30.0.38",
        "Cortex XDR Broker VM 30.0.39",
        "Cortex XDR Broker VM 30.0.40",
        "Cortex XDR Broker VM 30.0.41",
        "Cortex XDR Broker VM 30.0.42",
        "Cortex XDR Broker VM 30.0.43",
        "Cortex XDR Broker VM 30.0.44",
        "Cortex XDR Broker VM 30.0.45",
        "Cortex XDR Broker VM 30.0.46",
        "Cortex XDR Broker VM 30.0.47",
        "Cortex XDR Broker VM 30.0.48"
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2026-0231",
    "datePublished": "2026-03-11T18:03:21.302Z",
    "dateReserved": "2025-11-03T20:43:52.020Z",
    "dateUpdated": "2026-03-11T20:21:35.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-0231",
      "date": "2026-11-12",
      "epss": "0.00178",
      "percentile": "0.07433"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Cortex XDR Broker VM",
                "vendor": "Palo Alto Networks",
                "versions": [
                  {
                    "changes": [
                      {
                        "at": "30.0.49",
                        "status": "unaffected"
                      }
                    ],
                    "lessThan": "30.0.49",
                    "status": "affected",
                    "version": "30.0.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "psirt@paloaltonetworks.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An information disclosure vulnerability in\u00a0Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to obtain and modify sensitive information by triggering live terminal session via Cortex UI and modifying any configuration setting.\u00a0\nThe attacker must have network access to the Broker VM to exploit this issue."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n en Palo Alto Networks Cortex XDR\u00ae Broker VM permite a un usuario autenticado obtener y modificar informaci\u00f3n sensible al activar una sesi\u00f3n de terminal en vivo a trav\u00e9s de la interfaz de usuario de Cortex y modificar cualquier ajuste de configuraci\u00f3n.\nEl atacante debe tener acceso de red al Broker VM para explotar este problema."
          }
        ],
        "id": "CVE-2026-0231",
        "lastModified": "2026-06-17T10:10:34.487",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NO",
                "Recovery": "USER",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.7,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "UNREPORTED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "AMBER",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "DIFFUSE",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "source": "psirt@paloaltonetworks.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-0231",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-11T20:21:23.660381Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-03-11T18:16:21.413",
        "references": [
          {
            "source": "psirt@paloaltonetworks.com",
            "url": "https://security.paloaltonetworks.com/CVE-2026-0231"
          }
        ],
        "sourceIdentifier": "psirt@paloaltonetworks.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-497"
              }
            ],
            "source": "psirt@paloaltonetworks.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T08:14:23+00:00",
      "cve": "CVE-2026-0231",
      "id": "CVE-2026-0231",
      "initial_release_date": "2026-03-11T16:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0231.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-0231",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-03-11T20:21:23.660381Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-03-11T20:21:28.913Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Cortex XDR Broker VM",
              "vendor": "Palo Alto Networks",
              "versions": [
                {
                  "changes": [
                    {
                      "at": "30.0.49",
                      "status": "unaffected"
                    }
                  ],
                  "lessThan": "30.0.49",
                  "status": "affected",
                  "version": "30.0.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "eng",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "No special configuration is required to be affected by this issue."
                }
              ],
              "value": "No special configuration is required to be affected by this issue."
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:palo_alto_networks:cortex_xdr_broker_vm:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "30.0.49",
                      "versionStartIncluding": "30.0.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "OR"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "an internal reporter, Nicola Kalak,"
            }
          ],
          "datePublic": "2026-03-11T16:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "An information disclosure vulnerability in\u0026nbsp;Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to obtain and modify sensitive information by triggering live terminal session via Cortex UI \u003cspan\u003eand modifying any configuration setting\u003c/span\u003e.\u0026nbsp;\u003cbr\u003e\u003cp\u003eThe attacker must have network access to the Broker VM to exploit this issue.\u003c/p\u003e"
                }
              ],
              "value": "An information disclosure vulnerability in\u00a0Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to obtain and modify sensitive information by triggering live terminal session via Cortex UI and modifying any configuration setting.\u00a0\nThe attacker must have network access to the Broker VM to exploit this issue."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
                }
              ],
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-37",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NO",
                "Recovery": "USER",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 5.7,
                "baseSeverity": "MEDIUM",
                "exploitMaturity": "UNREPORTED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "AMBER",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "DIFFUSE",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-497",
                  "description": "CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-03-11T18:03:21.302Z",
            "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
            "shortName": "palo_alto"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://security.paloaltonetworks.com/CVE-2026-0231"
            }
          ],
          "solutions": [
            {
              "lang": "eng",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003e\u003cspan\u003eThis issue is fixed in Cortex XDR Broker VM  30.0.49, and all later Cortex XDR Broker VM versions.\u003c/span\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan\u003eIf automatic upgrades are enabled for Broker VM, then no action is required at this time.\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan\u003eIf automatic upgrades are not enabled for Broker VM, then we recommend that you do so to ensure that you always have the latest security patches installed in your software.\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
                }
              ],
              "value": "This issue is fixed in Cortex XDR Broker VM 30.0.49, and all later Cortex XDR Broker VM versions.\n\n * If automatic upgrades are enabled for Broker VM, then no action is required at this time.\n\n * If automatic upgrades are not enabled for Broker VM, then we recommend that you do so to ensure that you always have the latest security patches installed in your software."
            }
          ],
          "source": {
            "discovery": "INTERNAL"
          },
          "timeline": [
            {
              "lang": "en",
              "time": "2026-03-11T16:00:00.000Z",
              "value": "Initial Publication"
            }
          ],
          "title": "Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability",
          "workarounds": [
            {
              "lang": "eng",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "No known workarounds exist for this issue."
                }
              ],
              "value": "No known workarounds exist for this issue."
            }
          ],
          "x_affectedList": [
            "Cortex XDR Broker VM 30.0.0",
            "Cortex XDR Broker VM 30.0.1",
            "Cortex XDR Broker VM 30.0.2",
            "Cortex XDR Broker VM 30.0.3",
            "Cortex XDR Broker VM 30.0.4",
            "Cortex XDR Broker VM 30.0.5",
            "Cortex XDR Broker VM 30.0.6",
            "Cortex XDR Broker VM 30.0.7",
            "Cortex XDR Broker VM 30.0.8",
            "Cortex XDR Broker VM 30.0.9",
            "Cortex XDR Broker VM 30.0.10",
            "Cortex XDR Broker VM 30.0.11",
            "Cortex XDR Broker VM 30.0.12",
            "Cortex XDR Broker VM 30.0.13",
            "Cortex XDR Broker VM 30.0.14",
            "Cortex XDR Broker VM 30.0.15",
            "Cortex XDR Broker VM 30.0.16",
            "Cortex XDR Broker VM 30.0.17",
            "Cortex XDR Broker VM 30.0.18",
            "Cortex XDR Broker VM 30.0.19",
            "Cortex XDR Broker VM 30.0.20",
            "Cortex XDR Broker VM 30.0.21",
            "Cortex XDR Broker VM 30.0.22",
            "Cortex XDR Broker VM 30.0.23",
            "Cortex XDR Broker VM 30.0.24",
            "Cortex XDR Broker VM 30.0.25",
            "Cortex XDR Broker VM 30.0.26",
            "Cortex XDR Broker VM 30.0.27",
            "Cortex XDR Broker VM 30.0.28",
            "Cortex XDR Broker VM 30.0.29",
            "Cortex XDR Broker VM 30.0.30",
            "Cortex XDR Broker VM 30.0.31",
            "Cortex XDR Broker VM 30.0.32",
            "Cortex XDR Broker VM 30.0.33",
            "Cortex XDR Broker VM 30.0.34",
            "Cortex XDR Broker VM 30.0.35",
            "Cortex XDR Broker VM 30.0.36",
            "Cortex XDR Broker VM 30.0.37",
            "Cortex XDR Broker VM 30.0.38",
            "Cortex XDR Broker VM 30.0.39",
            "Cortex XDR Broker VM 30.0.40",
            "Cortex XDR Broker VM 30.0.41",
            "Cortex XDR Broker VM 30.0.42",
            "Cortex XDR Broker VM 30.0.43",
            "Cortex XDR Broker VM 30.0.44",
            "Cortex XDR Broker VM 30.0.45",
            "Cortex XDR Broker VM 30.0.46",
            "Cortex XDR Broker VM 30.0.47",
            "Cortex XDR Broker VM 30.0.48"
          ],
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "assignerShortName": "palo_alto",
        "cveId": "CVE-2026-0231",
        "datePublished": "2026-03-11T18:03:21.302Z",
        "dateReserved": "2025-11-03T20:43:52.020Z",
        "dateUpdated": "2026-03-11T20:21:35.933Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0277

Vulnerability from certfr_avis - Published: 2026-03-12 - Updated: 2026-03-12

De multiples vulnérabilités ont été découvertes dans les produits Palo Alto Networks. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Palo Alto Networks	N/A	Cortex XDR Broker VM versions 30.0.x antérieures à 30.0.49
Palo Alto Networks	N/A	Prisma Browser versions antérieures à 145.7.9.76
Palo Alto Networks	N/A	Cortex XDR Agent versions 8.7-CE antérieures à 8.7.101-CE pour macOS
Palo Alto Networks	N/A	Cortex XDR Agent versions 8.3-CE antérieures à 8.3.102-CE pour macOS

References

Title

Publication Time

FKIE_CVE-2026-0231

Vulnerability from fkie_nvd - Published: 2026-03-11 18:16 - Updated: 2026-06-17 10:10

Severity

5.7 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

Summary

References

	URL	Tags
	psirt@paloaltonetworks.com	https://security.paloaltonetworks.com/CVE-2026-0231

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Cortex XDR Broker VM",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "30.0.49",
                  "status": "unaffected"
                }
              ],
              "lessThan": "30.0.49",
              "status": "affected",
              "version": "30.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@paloaltonetworks.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An information disclosure vulnerability in\u00a0Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to obtain and modify sensitive information by triggering live terminal session via Cortex UI and modifying any configuration setting.\u00a0\nThe attacker must have network access to the Broker VM to exploit this issue."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n en Palo Alto Networks Cortex XDR\u00ae Broker VM permite a un usuario autenticado obtener y modificar informaci\u00f3n sensible al activar una sesi\u00f3n de terminal en vivo a trav\u00e9s de la interfaz de usuario de Cortex y modificar cualquier ajuste de configuraci\u00f3n.\nEl atacante debe tener acceso de red al Broker VM para explotar este problema."
    }
  ],
  "id": "CVE-2026-0231",
  "lastModified": "2026-06-17T10:10:34.487",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NO",
          "Recovery": "USER",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "UNREPORTED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "AMBER",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "DIFFUSE",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "MODERATE"
        },
        "source": "psirt@paloaltonetworks.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-0231",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-11T20:21:23.660381Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-11T18:16:21.413",
  "references": [
    {
      "source": "psirt@paloaltonetworks.com",
      "url": "https://security.paloaltonetworks.com/CVE-2026-0231"
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-497"
        }
      ],
      "source": "psirt@paloaltonetworks.com",
      "type": "Secondary"
    }
  ]
}

GHSA-RMFR-HR4X-H343

Vulnerability from github – Published: 2026-03-11 18:30 – Updated: 2026-03-11 18:30

Details

Severity

5.7 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-0231"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-497"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-11T18:16:21Z",
    "severity": "MODERATE"
  },
  "details": "An information disclosure vulnerability in\u00a0Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to obtain and modify sensitive information by triggering live terminal session via Cortex UI and modifying any configuration setting.\u00a0\nThe attacker must have network access to the Broker VM to exploit this issue.",
  "id": "GHSA-rmfr-hr4x-h343",
  "modified": "2026-03-11T18:30:33Z",
  "published": "2026-03-11T18:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0231"
    },
    {
      "type": "WEB",
      "url": "https://security.paloaltonetworks.com/CVE-2026-0231"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

WID-SEC-W-2026-0701

Vulnerability from csaf_certbund - Published: 2026-03-11 23:00 - Updated: 2026-03-11 23:00

Summary

Palo Alto Networks Cortex XDR: Mehrere Schwachstellen

Severity

Mittel

Scope

2 vulnerabilities in this advisory, including CVE-2026-0231.

CVE-2026-0231

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-0231 (GCVE-0-2026-0231)

CERTFR-2026-AVI-0277

Solutions

FKIE_CVE-2026-0231

GHSA-RMFR-HR4X-H343

WID-SEC-W-2026-0701

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour