Palo Alto Cortex XDR Broker VM up to 30.0.48 Cortex UI information expsure

Summaryinfo

A vulnerability classified as problematic has been found in Palo Alto Cortex XDR Broker VM up to 30.0.48. The impacted element is an unknown function of the component Cortex UI. The manipulation leads to information expsure. This vulnerability is traded as CVE-2026-0231. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Palo Alto Cortex XDR Broker VM up to 30.0.48. This issue affects some unknown processing of the component Cortex UI. The manipulation with an unknown input leads to a information expsure vulnerability. Using CWE to declare the problem leads to CWE-497. The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An information disclosure vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to obtain and modify sensitive information by triggering live terminal session via Cortex UI and modifying any configuration setting.  The attacker must have network access to the Broker VM to exploit this issue.

The weakness was shared by Nicola Kalak. The advisory is shared at security.paloaltonetworks.com. The identification of this vulnerability is CVE-2026-0231 since 11/03/2025. The exploitation is known to be easy. An attack has to be approached locally. Additional levels of successful authentication are needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 30.0.49 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-11251). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Palo Alto

Name

• Cortex XDR Broker VM

Version

• 30.0.0
• 30.0.1
• 30.0.2
• 30.0.3
• 30.0.4
• 30.0.5
• 30.0.6
• 30.0.7
• 30.0.8
• 30.0.9
• 30.0.10
• 30.0.11
• 30.0.12
• 30.0.13
• 30.0.14
• 30.0.15
• 30.0.16
• 30.0.17
• 30.0.18
• 30.0.19
• 30.0.20
• 30.0.21
• 30.0.22
• 30.0.23
• 30.0.24
• 30.0.25
• 30.0.26
• 30.0.27
• 30.0.28
• 30.0.29
• 30.0.30
• 30.0.31
• 30.0.32
• 30.0.33
• 30.0.34
• 30.0.35
• 30.0.36
• 30.0.37
• 30.0.38
• 30.0.39
• 30.0.40
• 30.0.41
• 30.0.42
• 30.0.43
• 30.0.44
• 30.0.45
• 30.0.46
• 30.0.47
• 30.0.48

License

• commercial

Website

• Vendor: https://www.paloaltonetworks.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion