Vulnerability-Lookup

BDU:2025-05726

Vulnerability from fstec - Published: 14.05.2025

Title

Уязвимость брокера Broker VM платформы безопасности Cortex XDR, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код

Description

Уязвимость брокера Broker VM платформы безопасности Cortex XDR связана с неверным управлением генерацией кода. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код

Severity ?


                    
                      AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L


                    
                      AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber

Vendor

Palo Alto Networks Inc.

Software Name

Broker VM

Software Version

от 26.0.0 до 26.0.119 (Broker VM)

Possible Mitigations

Использование рекомендаций: https://security.paloaltonetworks.com/CVE-2025-0134

Reference

https://security.paloaltonetworks.com/CVE-2025-0134

CWE

CWE-94

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
  "CVSS 4.0": "AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber",
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Palo Alto Networks Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 26.0.0 \u0434\u043e 26.0.119 (Broker VM)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://security.paloaltonetworks.com/CVE-2025-0134",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "14.05.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "13.08.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "21.05.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-05726",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-0134",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Broker VM",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0440\u043e\u043a\u0435\u0440\u0430 Broker VM \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Cortex XDR, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430 (\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430) (CWE-94)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0440\u043e\u043a\u0435\u0440\u0430 Broker VM \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Cortex XDR \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://security.paloaltonetworks.com/CVE-2025-0134",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438/\u041f\u041e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-94",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,5)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,4)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 4.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,5)"
}

CVE-2025-0134 (GCVE-0-2025-0134)

Vulnerability from cvelistv5 – Published: 2025-05-14 18:07 – Updated: 2026-02-26 18:28

Title

Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM

Summary

A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM.

Severity ?

6.5 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

palo_alto

References

URL

Tags

https://security.paloaltonetworks.com/CVE-2025-0134

vendor-advisory

Impacted products

	Vendor	Product	Version
	Palo Alto Networks	Cortex XDR Broker VM	Affected: 26.0.0 , < 26.0.119 (custom) cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.10:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.3:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.119:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.116:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.100.4:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.0.44:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.100.4:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.4.7:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.2.8:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.5.1:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.100.2:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.35:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.33:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.35:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.32:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:21.5.4:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:20.9.1:::::::*

Date Public ?

2025-05-14 16:00

Credits

Christiaan van Aken

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0134",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-15T04:02:10.628623Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T18:28:08.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.119:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.116:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.100.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.0.44:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.100.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.5.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.100.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.35:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.33:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.35:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.32:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:21.5.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:20.9.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Cortex XDR Broker VM",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "26.0.119",
                  "status": "unaffected"
                }
              ],
              "lessThan": "26.0.119",
              "status": "affected",
              "version": "26.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "No special configuration is required to be affected by this issue."
            }
          ],
          "value": "No special configuration is required to be affected by this issue."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christiaan van Aken"
        }
      ],
      "datePublic": "2025-05-14T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A code injection vulnerability in the Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM."
            }
          ],
          "value": "A code injection vulnerability in the Palo Alto Networks Cortex XDR\u00ae Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "USER",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-14T18:07:54.706Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2025-0134"
        }
      ],
      "solutions": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue is fixed in Cortex XDR Broker VM 26.0.119, and all later Cortex XDR Broker VM versions. \u003cbr\u003e\u003cul\u003e\u003cli\u003eIf you enabled automatic upgrades for Broker VM, then no action is required at this time.\u003c/li\u003e\u003cli\u003eIf you did not enable automatic upgrades, then we recommend you do so for Broker VM to ensure that you always have the latest security patches installed in your software.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "This issue is fixed in Cortex XDR Broker VM 26.0.119, and all later Cortex XDR Broker VM versions. \n  *  If you enabled automatic upgrades for Broker VM, then no action is required at this time.\n  *  If you did not enable automatic upgrades, then we recommend you do so for Broker VM to ensure that you always have the latest security patches installed in your software."
        }
      ],
      "source": {
        "defect": [
          "CRTX-105741"
        ],
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-05-14T16:00:00.000Z",
          "value": "Initial Publication"
        }
      ],
      "title": "Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There are no known workarounds or mitigations for this issue."
            }
          ],
          "value": "There are no known workarounds or mitigations for this issue."
        }
      ],
      "x_affectedList": [
        "Cortex XDR Broker VM 26.0.0",
        "Cortex XDR Broker VM 26.0.1",
        "Cortex XDR Broker VM 26.0.2",
        "Cortex XDR Broker VM 26.0.3",
        "Cortex XDR Broker VM 26.0.4",
        "Cortex XDR Broker VM 26.0.5",
        "Cortex XDR Broker VM 26.0.6",
        "Cortex XDR Broker VM 26.0.7",
        "Cortex XDR Broker VM 26.0.8",
        "Cortex XDR Broker VM 26.0.9",
        "Cortex XDR Broker VM 26.0.10",
        "Cortex XDR Broker VM 26.0.11",
        "Cortex XDR Broker VM 26.0.12",
        "Cortex XDR Broker VM 26.0.13",
        "Cortex XDR Broker VM 26.0.14",
        "Cortex XDR Broker VM 26.0.15",
        "Cortex XDR Broker VM 26.0.16",
        "Cortex XDR Broker VM 26.0.17",
        "Cortex XDR Broker VM 26.0.18",
        "Cortex XDR Broker VM 26.0.19",
        "Cortex XDR Broker VM 26.0.20",
        "Cortex XDR Broker VM 26.0.21",
        "Cortex XDR Broker VM 26.0.22",
        "Cortex XDR Broker VM 26.0.23",
        "Cortex XDR Broker VM 26.0.24",
        "Cortex XDR Broker VM 26.0.25",
        "Cortex XDR Broker VM 26.0.26",
        "Cortex XDR Broker VM 26.0.27",
        "Cortex XDR Broker VM 26.0.28",
        "Cortex XDR Broker VM 26.0.29",
        "Cortex XDR Broker VM 26.0.30",
        "Cortex XDR Broker VM 26.0.31",
        "Cortex XDR Broker VM 26.0.32",
        "Cortex XDR Broker VM 26.0.33",
        "Cortex XDR Broker VM 26.0.34",
        "Cortex XDR Broker VM 26.0.35",
        "Cortex XDR Broker VM 26.0.36",
        "Cortex XDR Broker VM 26.0.37",
        "Cortex XDR Broker VM 26.0.38",
        "Cortex XDR Broker VM 26.0.39",
        "Cortex XDR Broker VM 26.0.40",
        "Cortex XDR Broker VM 26.0.41",
        "Cortex XDR Broker VM 26.0.42",
        "Cortex XDR Broker VM 26.0.43",
        "Cortex XDR Broker VM 26.0.44",
        "Cortex XDR Broker VM 26.0.45",
        "Cortex XDR Broker VM 26.0.46",
        "Cortex XDR Broker VM 26.0.47",
        "Cortex XDR Broker VM 26.0.48",
        "Cortex XDR Broker VM 26.0.49",
        "Cortex XDR Broker VM 26.0.50",
        "Cortex XDR Broker VM 26.0.51",
        "Cortex XDR Broker VM 26.0.52",
        "Cortex XDR Broker VM 26.0.53",
        "Cortex XDR Broker VM 26.0.54",
        "Cortex XDR Broker VM 26.0.55",
        "Cortex XDR Broker VM 26.0.56",
        "Cortex XDR Broker VM 26.0.57",
        "Cortex XDR Broker VM 26.0.58",
        "Cortex XDR Broker VM 26.0.59",
        "Cortex XDR Broker VM 26.0.60",
        "Cortex XDR Broker VM 26.0.61",
        "Cortex XDR Broker VM 26.0.62",
        "Cortex XDR Broker VM 26.0.63",
        "Cortex XDR Broker VM 26.0.64",
        "Cortex XDR Broker VM 26.0.65",
        "Cortex XDR Broker VM 26.0.66",
        "Cortex XDR Broker VM 26.0.67",
        "Cortex XDR Broker VM 26.0.68",
        "Cortex XDR Broker VM 26.0.69",
        "Cortex XDR Broker VM 26.0.70",
        "Cortex XDR Broker VM 26.0.71",
        "Cortex XDR Broker VM 26.0.72",
        "Cortex XDR Broker VM 26.0.73",
        "Cortex XDR Broker VM 26.0.74",
        "Cortex XDR Broker VM 26.0.75",
        "Cortex XDR Broker VM 26.0.76",
        "Cortex XDR Broker VM 26.0.77",
        "Cortex XDR Broker VM 26.0.78",
        "Cortex XDR Broker VM 26.0.79",
        "Cortex XDR Broker VM 26.0.80",
        "Cortex XDR Broker VM 26.0.81",
        "Cortex XDR Broker VM 26.0.82",
        "Cortex XDR Broker VM 26.0.83",
        "Cortex XDR Broker VM 26.0.84",
        "Cortex XDR Broker VM 26.0.85",
        "Cortex XDR Broker VM 26.0.86",
        "Cortex XDR Broker VM 26.0.87",
        "Cortex XDR Broker VM 26.0.88",
        "Cortex XDR Broker VM 26.0.89",
        "Cortex XDR Broker VM 26.0.90",
        "Cortex XDR Broker VM 26.0.91",
        "Cortex XDR Broker VM 26.0.92",
        "Cortex XDR Broker VM 26.0.93",
        "Cortex XDR Broker VM 26.0.94",
        "Cortex XDR Broker VM 26.0.95",
        "Cortex XDR Broker VM 26.0.96",
        "Cortex XDR Broker VM 26.0.97",
        "Cortex XDR Broker VM 26.0.98",
        "Cortex XDR Broker VM 26.0.99",
        "Cortex XDR Broker VM 26.0.100",
        "Cortex XDR Broker VM 26.0.101",
        "Cortex XDR Broker VM 26.0.102",
        "Cortex XDR Broker VM 26.0.103",
        "Cortex XDR Broker VM 26.0.104",
        "Cortex XDR Broker VM 26.0.105",
        "Cortex XDR Broker VM 26.0.106",
        "Cortex XDR Broker VM 26.0.107",
        "Cortex XDR Broker VM 26.0.108",
        "Cortex XDR Broker VM 26.0.109",
        "Cortex XDR Broker VM 26.0.110",
        "Cortex XDR Broker VM 26.0.111",
        "Cortex XDR Broker VM 26.0.112",
        "Cortex XDR Broker VM 26.0.113",
        "Cortex XDR Broker VM 26.0.114",
        "Cortex XDR Broker VM 26.0.115",
        "Cortex XDR Broker VM 26.0.116",
        "Cortex XDR Broker VM 26.0.117",
        "Cortex XDR Broker VM 26.0.118"
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2025-0134",
    "datePublished": "2025-05-14T18:07:54.706Z",
    "dateReserved": "2024-12-20T23:23:34.744Z",
    "dateUpdated": "2026-02-26T18:28:08.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2025-05726

CVE-2025-0134 (GCVE-0-2025-0134)

Tags

Sightings

Nomenclature