Palo Alto Networks Cortex XDR Broker VM Code Injection Vulnerability Allowing Root Privilege Escalation

A code injection vulnerability has been identified in the Palo Alto Networks Cortex XDR Broker VM, specifically in versions prior to 26.0.119. This vulnerability allows an authenticated user to execute arbitrary code with root privileges on the host operating system where the Broker VM is running.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution with root privileges on the host operating system.

Remediation

Users can upgrade to Cortex XDR Broker VM version 26.0.119 or later to address this vulnerability. For those who have not enabled automatic upgrades, it is recommended to do so to ensure the latest security patches are applied.