Which versions of CommvaultSecurityIQ Integration are affected by CVE-2026-0274?

Palo Alto Networks Cortex XSOAR and XSIAM face a critical unauthenticated remote access vulnerability (CVE-2026-0274, CVSS 8.1) in the CommvaultSecurityIQ integration that enables attackers to access…. A patch is available.

How to fix or mitigate CVE-2026-0274?

Within 24 hours: identify all XSOAR and XSIAM deployments using CommvaultSecurityIQ integration and assess external network exposure. Within 7 days: implement network segmentation to restrict access to affected systems, disable the integration if operationally feasible, and enable detailed access logging and alerting for anomalies. Within 30 days: apply vendor-provided patch immediately upon release and conduct comprehensive forensic analysis of access logs for unauthorized activity.

CommvaultSecurityIQ Integration CVE-2026-0274

Q: What is the CVSS score of CVE-2026-0274?

CVE-2026-0274 has a CVSS 4.0 base score of 8.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red. EPSS exploitation probability: 0.0%.

EUVD-2026-36150 HIGH

Weak Authentication (CWE-1390)

2026-06-10 palo_alto

GHSA-fx9p-pvqh-vrhg

Information Disclosure Cortex Xsiam Commvaultsecurityiq Marketplace Cortex Xsoar Commvaultsecurityiq Marketplace

8.1

CVSS 4.0 · Vendor: palo_alto

Severity by source

Vendor (palo_alto) PRIMARY

8.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red

vuln.today AI

9.1 CRITICAL

Description states unauthenticated network access to read and modify protected resources, so AV:N/AC:L/PR:N/UI:N with C:H and I:H; availability impact is not described, so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (palo_alto).

CVSS VectorVendor: palo_alto

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 23:01 EUVD

Analysis Generated

Jun 10, 2026 - 22:01 vuln.today

DescriptionCVE.org

An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.

AnalysisAI

Improper credential validation in the CommvaultSecurityIQ integration for Palo Alto Networks Cortex XSOAR and Cortex XSIAM allows remote attackers to read and modify protected resources without authentication. The CVSS 4.0 base score of 8.1 reflects high impact to confidentiality, integrity, and availability across a network-reachable attack surface, though no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw resides in the CommvaultSecurityIQ content pack/marketplace integration shipped for Palo Alto's Cortex XSOAR (security orchestration, automation, and response) and Cortex XSIAM (extended security intelligence and automation management) platforms. CWE-1390 (Weak Authentication) describes a category where the authentication mechanism either fails to validate credentials correctly or accepts unintended inputs as valid, which here permits requests to reach protected Commvault resources without proper verification. The CPEs cortex_xsiam_commvaultsecurityiq_marketplace and cortex_xsoar_commvaultsecurityiq_marketplace confirm that the defect is in the marketplace-distributed integration code, not the core Cortex platforms themselves.

RemediationAI

Patch available per vendor advisory: review https://security.paloaltonetworks.com/CVE-2026-0274 and update the CommvaultSecurityIQ marketplace content pack in both Cortex XSOAR and Cortex XSIAM tenants to the fixed version listed by Palo Alto Networks. If immediate update is not possible, compensating controls include disabling or uninstalling the CommvaultSecurityIQ integration pack from the marketplace (trade-off: loss of Commvault backup orchestration and incident-response automation), restricting network reachability to the integration endpoint via tenant firewall or zone segmentation so only authorized SOAR engines can call it (trade-off: may break legitimate playbook execution from other workers), and rotating any Commvault API credentials that were stored within the integration once the fix is applied.