Medium · 6.5 CVE-2025-0134 EUVD-2025-14902GHSA-ghvv-mg26-g3c9

Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM

Published May 14, 2025 · Updated Feb 26, 2026 · Assigned by palo_alto

Vendor: Palo Alto Networks Product: Cortex XDR Broker VM Category: Network devices

Description

A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM.

Affected products

Vendor	Product	Affected	Fixed
Palo Alto Networks	Cortex XDR Broker VM	26.0.0 – < 26.0.119	26.0.119

References

https://security.paloaltonetworks.com/CVE-2025-0134 vendor-advisory