Which versions of Jwt Attack are affected by CVE-2026-0234?

Palo Alto Networks Cortex XSOAR and XSIAM Microsoft Teams integrations versions 1.5.0-1.5.51 contain a cryptographic signature bypass vulnerability that allows unauthenticated attackers to forge…. A patch is available.

How to fix or mitigate CVE-2026-0234?

Within 24 hours: Identify all deployments of Cortex XSOAR and XSIAM with Microsoft Teams integration versions 1.5.0-1.5.51; disable or isolate affected integrations pending patching. Within 7 days: upgrade Microsoft Teams integration to version 1.5.52 or later on all affected instances; test functionality post-upgrade. Within 30 days: audit Microsoft Teams integration logs for anomalous token usage or unauthorized resource access since deployment; implement token pinning and API rate limiting on Teams integration endpoints.

Jwt Attack CVE-2026-0234

Q: What is the CVSS score of CVE-2026-0234?

CVE-2026-0234 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red. EPSS exploitation probability: 0.0%.

EUVD-2026-21899 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-04-13 palo_alto

GHSA-w48x-mvpf-jfc3

Information Disclosure Microsoft Jwt Attack Cortex Xsoar Microsoft Teams Marketplace Cortex Xsiam Microsoft Teams Marketplace

7.2

CVSS 4.0 · Vendor: palo_alto

Severity by source

Vendor (palo_alto) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red

Primary rating from Vendor (palo_alto) · only source for this CVE.

CVSS VectorVendor: palo_alto

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:57 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.5.52

Patch released

Apr 13, 2026 - 15:01 nvd

Patch available

Analysis Generated

Apr 13, 2026 - 10:01 vuln.today

CVSS changed

Apr 13, 2026 - 08:22 NVD

7.2 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 07:45 euvd

EUVD-2026-21899

Analysis Generated

Apr 13, 2026 - 07:45 vuln.today

CVE Published

Apr 13, 2026 - 07:15 nvd

HIGH 7.2

DescriptionCVE.org

An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify protected resources.

AnalysisAI

Cryptographic signature bypass in Palo Alto Networks Cortex XSOAR and XSIAM Microsoft Teams integrations (versions 1.5.0 through 1.5.51) allows unauthenticated remote attackers to access and modify protected resources. The vulnerability stems from improper JWT verification (CWE-347), enabling attackers to forge authentication tokens. With CVSS 7.2 (High complexity, network-accessible, no privileges required) and tags indicating JWT attack vectors and information disclosure potential, this represents a critical integration security flaw requiring immediate patching to version 1.5.52 or later.

Technical ContextAI

This vulnerability affects the Microsoft Teams marketplace integrations for both Cortex XSOAR (Security Orchestration, Automation and Response) and Cortex XSIAM (Extended Security Intelligence and Automation Management) platforms. The root cause is CWE-347 (Improper Verification of Cryptographic Signature), specifically related to JSON Web Token (JWT) validation failures. JWTs are cryptographic tokens used to authenticate API requests between integrated services. When signature verification is improperly implemented, attackers can forge valid-looking tokens by manipulating the JWT header or payload without possessing the legitimate signing key. In Microsoft Teams integrations, these tokens typically authenticate webhook callbacks and API interactions. The affected CPE strings indicate this is specific to the Microsoft Teams Marketplace component versions 1.5.0 through 1.5.51 in both XSOAR and XSIAM platforms, not the core platforms themselves.

RemediationAI

Upgrade the Microsoft Teams Marketplace integration to version 1.5.52 or later for both Cortex XSOAR and Cortex XSIAM platforms, as this version contains fixes for the cryptographic signature verification flaw. Access the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0234 for official update guidance and distribution channels. Until patching is complete, consider temporarily disabling the Microsoft Teams integration if it is not critical to operations, or implement additional network-level access controls to restrict integration endpoint exposure. Review authentication logs for the Teams integration during the vulnerable period for any suspicious access patterns or unauthorized resource modifications that may indicate exploitation attempts.