Cortex XDR Broker VM EUVD-2026-42690

Exploitation requires an active local authenticated session on the Cortex XDR Broker VM appliance; the CVSS vector AV:L/PR:L confirms this explicitly. Network-based or unauthenticated remote exploitation is not possible. No special configuration is required (AT:N), meaning the flaw is present in default Broker VM deployments without any additional setup. Exploitation is limited to users who have already been granted local login access to the VM - in typical enterprise deployments, this is restricted to system administrators, which substantially reduces the realistic attack population. The absence of scope change (SC:N/SI:N/SA:N) means root on the Broker VM does not directly enable compromise of adjacent systems or the Cortex XDR cloud tenant.

The vendor-assigned CVSS 4.0 score of 1.1 is among the lowest possible ratings, driven by local attack vector (AV:L), low-privilege requirement (PR:L), unexploited threat status (E:U), and low impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with zero scope change to subsequent systems. These signals are internally consistent: local access constraints mean network-based attackers cannot exploit this directly, and the low C/I/A ratings imply that root on the Broker VM yields limited data exposure given the appliance's narrow functional role. No EPSS score was provided in available data, and no CISA KEV listing exists, further supporting a low-priority risk classification. The primary real-world concern is insider threat or post-compromise lateral escalation within the Broker VM itself. The Amber urgency designation in the CVSS 4.0 supplemental metrics (U:Amber) suggests the vendor considers it relevant but non-critical for patching prioritization. No conflicting signals are present in available data.

An attacker with existing local authentication to the Cortex XDR Broker VM - such as a malicious insider or an attacker who has already established a foothold via another vulnerability - exploits the improper privilege management flaw to elevate their session to root. With root access, the attacker can read or modify Broker VM configuration, potentially exposing credentials or communication keys used between the VM and the Cortex XDR cloud. No public exploit code has been identified, making opportunistic exploitation unlikely.