4.6
Medium
CVE-2025-4228 Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
Description
An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.
CVSS 4.0 detail
Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:AmberExploitable with local access to the machine, with an administrator account and without any user action; the impact on data or service is limited.
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- High
- Interaction
- None
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cortex XDR Broker VM 27.0 | 27.0.0 → < 27.0.26 | 27.0.26 |
Other CVEs of Cortex XDR Broker VM
The 9 CVEs of Cortex XDR Broker VM →
CVE-2026-0304
A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low…
4.8
Medium
CVE-2026-0276
A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to…
1.1
Low
CVE-2026-0231
An information disclosure vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to…
5.7
Medium
CVE-2025-2184
A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share…
5.3
Medium