Is there a patch available for CVE-2026-0276?

Yes, a patch is available for CVE-2026-0276. Update the affected software to the latest version immediately.

Cortex XDR Broker VM CVE-2026-0276

Q: What is the CVSS score of CVE-2026-0276?

CVE-2026-0276 has a CVSS 4.0 base score of 1.1 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber. EPSS exploitation probability: 0.1%.

EUVD-2026-42690 LOW

Improper Privilege Management (CWE-269)

2026-07-09 palo_alto

GHSA-8fv5-24p8-44h5

Privilege Escalation Paloalto Cortex Xdr Broker Vm

1.1

CVSS 4.0 · Vendor: palo_alto

Severity by source

Vendor (palo_alto) PRIMARY

1.1 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber

vuln.today AI

5.3 MEDIUM

Local access and low privilege required; root on a narrow-function VM appliance yields limited C/I/A with no scope change beyond the VM.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (palo_alto).

CVSS VectorVendor: palo_alto

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 21:01 EUVD

Analysis Generated

Jul 09, 2026 - 20:26 vuln.today

DescriptionCVE.org

A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user.

AnalysisAI

Privilege escalation in Palo Alto Networks Cortex XDR Broker VM permits locally authenticated users to perform operations as the root user within the appliance. The vulnerability is constrained to the Broker VM itself - the CVSS 4.0 vector (SC:N/SI:N/SA:N) confirms no scope change to subsequent or adjacent systems, limiting the blast radius to the VM appliance. No public exploit exists (E:U) and no CISA KEV listing is present; the vendor-assigned CVSS 4.0 score of 1.1 reflects this low-urgency posture.

Technical ContextAI

The Cortex XDR Broker VM is a virtualized intermediary component in Palo Alto Networks' Cortex XDR platform, functioning as a communication proxy between endpoint/network sensors deployed in segmented environments and the Cortex XDR cloud backend. CWE-269 (Improper Privilege Management) identifies the root cause class: the software fails to correctly restrict, assign, or enforce privilege boundaries, allowing a lower-privileged user's session to invoke root-level operations. The CPE string cpe:2.3:a:palo_alto_networks:cortex_xdr_broker_vm:*:*:*:*:*:*:*:* covers all version branches of the Broker VM without a constrained version range, suggesting the flaw is present across the product's history as deployed.

RemediationAI

Consult the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0276 for the official patch and fixed version, as no specific remediated version was provided in available intelligence data. As an interim compensating control, restrict local shell or console access to the Cortex XDR Broker VM exclusively to authorized system administrators - eliminating the locally authenticated user attack surface removes all practical exploitation paths given the AV:L requirement. Ensure the Broker VM is not shared with non-administrative personnel or accessible via shared accounts. Monitor local session activity on the Broker VM via SIEM integration if the appliance supports audit logging. Note that restricting local access does not carry functional trade-offs for the XDR brokering function, which operates independently of interactive user sessions.