CVE-2025-0134

Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM

Published May 14, 2025 CVSS 4.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Palo Alto Networks

Cortex XDR Broker VM

unaffected

Version	Status	Constraints
`26.0.0`	affected	< 26.0.119

No data.

No data available yet.

Remediation

Vendor Workaround

There are no known workarounds or mitigations for this issue.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-14902	A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.530% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://security.paloaltonetworks.com/CVE-2025-0134

History

Feb 27, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

May 14, 2025 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 14, 2025 6:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM.
Title		Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM
First Time appeared		Paloaltonetworks Paloaltonetworks cortex Xdr Broker Vm
Weaknesses		CWE-94
CPEs		cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:20.9.1:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:21.5.4:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.32:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.35:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.33:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.35:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.100.2:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.100.4:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.2.8:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.4.7:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.5.1:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.0.44:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.100.4:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.116:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.119:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.10:::::::* cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.3:::::::*
Vendors & Products		Paloaltonetworks Paloaltonetworks cortex Xdr Broker Vm
References		https://security.paloaltonetworks.com/CVE-2025-0134
Metrics		cvssV4_0 `{'score': 6.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber'}`