CVE-2026-0304

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in Palo Alto Networks Cortex XDR Broker VM

Publication date: 2026-09-10

Last updated on: 2026-09-11

Assigner: Palo Alto Networks, Inc.

Description

A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-11

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-0304

EUVD

EUVD-2026-75268

Affected Vendors & Products

Vendor	Product	Version / Range
palo_alto_networks	cortex_xdr_broker_vm	From 20.0.96 (inc) to 32.0.52 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

This is a privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM. An authenticated low-privileged user with man-in-the-middle access can execute code with root privileges on the Broker VM.

Detection Guidance

Detecting this vulnerability requires checking the version of Cortex XDR Broker VM. If your version is between 20.0.96 and below 32.0.52, the system is vulnerable. Use commands like 'show system info' or check the version in the admin console to verify.

Impact Analysis

An attacker could gain full control over the Broker VM, potentially accessing sensitive data, disrupting operations, or using it as a foothold to move laterally within a network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements for data protection and privacy such as GDPR or HIPAA.

Mitigation Strategies

Immediately upgrade Cortex XDR Broker VM to version 32.0.52 or later. Automatic upgrades are recommended to ensure security patches are applied. If upgrading is not possible, isolate the Broker VM from untrusted networks to prevent MitM attacks.

Hi! I’m here to help you understand CVE-2026-0304. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70