Palo Alto Networks Cortex XDR Broker VM Unauthorized Access to Docker Containers Vulnerability

A vulnerability in the network isolation mechanism of Palo Alto Networks Cortex XDR Broker VM versions prior to 26.0.116 allows unauthorized access to Docker containers from the host network used by the Broker VM. This access could enable attackers to read files sent for analysis and logs transmitted by the Cortex XDR Agent to the Cortex XDR server.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files and logs within Docker containers managed by the Cortex XDR Broker VM.

Remediation

Users can upgrade to Cortex XDR Broker VM version 26.0.116 or later. If automatic upgrades are not enabled, it is recommended to do so to ensure the latest security patches are applied.