Is there a patch available for CVE-2026-0270?

Yes, a patch is available for CVE-2026-0270. Update the affected software to the latest version immediately.

Cortex XSOAR CVE-2026-0270

Q: What is the CVSS score of CVE-2026-0270?

CVE-2026-0270 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-36146 MEDIUM

Path Traversal (CWE-22)

2026-06-10 palo_alto

GHSA-6p7f-m9mh-p8gq

Path Traversal Paloalto Cortex Xsoar Palo Alto Networks

4.8

CVSS 4.0 · Vendor: palo_alto

Severity by source

Vendor (palo_alto) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Amber

vuln.today AI

7.1 HIGH

AV:A for adjacency-only MITM requirement; AC:H for active interception prerequisite; PR:N unauthenticated; UI:R because victim system must initiate the interceptable request; full C/I/A:H reflecting arbitrary file write enabling code execution.

3.1 AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (palo_alto).

CVSS VectorVendor: palo_alto

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 23:01 EUVD

Analysis Generated

Jun 10, 2026 - 22:01 vuln.today

CVE Published

Jun 10, 2026 - 20:59 cve.org

MEDIUM 4.8

DescriptionCVE.org

A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle (MITM) attack, to write arbitrary files to the host.

AnalysisAI

Path traversal in Palo Alto Networks Cortex XSOAR engine on Linux enables arbitrary file write to the host system by an unauthenticated adjacent-network attacker who can intercept and manipulate outbound network response traffic via MITM. The referenced NVD entry for CVE-2007-4559 - the canonical Python tarfile path traversal - strongly suggests XSOAR's content pack or update download pipeline uses Python's tarfile module without path sanitization, allowing a poisoned archive to escape the extraction directory. No public exploit code has been identified at time of analysis, and the CVSS 4.0 supplemental metrics classify exploitation as unreported (E:U), though the attack is rated automatable (AU:Y) once MITM positioning is achieved.

Technical ContextAI

Cortex XSOAR is a security orchestration, automation, and response (SOAR) platform from Palo Alto Networks. The affected component is the engine software running on Linux, identified via CPE cpe:2.3:a:palo_alto_networks:cortex_xsoar:*:*:*:*:*:*:*:*. CWE-22 (Path Traversal) describes the root cause: the engine processes a remotely-sourced archive (likely a content pack or integration update fetched over the network) without normalizing or validating embedded file paths for directory-traversal sequences (e.g., '../'). The cross-reference to NVD CVE-2007-4559 is a strong indicator that the XSOAR engine relies on Python's built-in tarfile module, which historically does not strip or reject '../' components in archive member names, enabling a crafted tarball to write files to arbitrary host filesystem paths outside the intended extraction root.

RemediationAI

The primary fix is to apply the vendor-supplied patch from Palo Alto Networks detailed at https://security.paloaltonetworks.com/CVE-2026-0270; however, an exact patched version number is not confirmed in the available data and administrators should consult the advisory directly to identify the target upgrade version. As a compensating control, enforce strict network segmentation to ensure Cortex XSOAR hosts can only communicate with authorized content or update servers over trusted, encrypted channels (TLS with certificate pinning or mutual TLS), which would defeat a passive MITM attack. Deploying network-layer controls - such as 802.1X, private VLANs, or dynamic ARP inspection - on the segment hosting XSOAR engines reduces an attacker's ability to achieve ARP/DNS poisoning required for adjacency-based MITM. Disabling automatic content pack downloads or routing update traffic through an authenticated forward proxy adds an additional barrier. Each of these workarounds has a trade-off: certificate pinning may break legitimate update flows if certificates rotate; 802.1X requires infrastructure investment; proxy routing adds latency and a single point of failure.