Palo Alto Networks Cortex XDR Broker VM Credential Management Flaw Allowing Access to Internal Services

A credential management vulnerability exists in Palo Alto Networks Cortex XDR Broker VM versions 28.0.0 prior to 28.0.52. This flaw allows different Broker VM images to share the same default credentials for internal services. Users with knowledge of these default credentials could access internal services on other Broker VM installations. Exploitation requires network access to the Broker VM.

Impact

Exploitation of this vulnerability could lead to unauthorized access to internal services on other Broker VM installations, potentially allowing for further actions depending on the accessed services.

Remediation

Users with automatic upgrades enabled for Broker VM do not need to take any action. Those without automatic upgrades should enable this feature to ensure the latest security patches are applied.