EUVD-2026-75268
GHSA-v97p-xg3v-qpf2
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Adjacent vector and high complexity reflect the mandatory pre-established MitM prerequisite; low privileges required per description; full system impact from root code execution on the Broker VM.
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
2DescriptionCVE.org
A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.
AnalysisAI
Privilege escalation to root on Palo Alto Networks Cortex XDR Broker VM is achievable by an authenticated low-privileged user who simultaneously holds a man-in-the-middle position on the adjacent network segment. The underlying flaw is argument injection (CWE-88), allowing the attacker to manipulate command-line arguments processed by the Broker VM to gain root-level code execution on the appliance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous prerequisites: (1) the attacker must possess a valid low-privileged account with access to the Cortex XDR Broker VM (PR:L per vendor CVSS 4.0 vector), and (2) the attacker must achieve and maintain a man-in-the-middle position on the network segment adjacent to the Broker VM before or during exploitation (AV:A, AT:P per vendor CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 4.8 (Amber urgency) correctly reflects a bounded but genuine internal threat: AV:A restricts exploitation to attackers already present on the adjacent network segment, PR:L demands a valid low-privileged credential, and AT:P confirms that a pre-established man-in-the-middle position is a hard prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the Palo Alto Networks-issued update for Cortex XDR Broker VM as detailed in the vendor advisory at https://security.paloaltonetworks.com/CVE-2026-0304; the precise fixed version must be confirmed there as it is not independently available in the current data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cortex Xdr Broker Vm
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today