CVE-2026-0270

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0270", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2025-11-03T20:44:30.311Z", "datePublished": "2026-06-10T20:59:00.350Z", "dateUpdated": "2026-06-12T03:55:34.115Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-06-10T20:59:00.350Z"}, "title": "Cortex XSOAR: Path Traversal Vulnerability", "datePublic": "2026-06-10T16:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "Cortex XSOAR", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "8.13", "lessThan": "8.13.0.11", "changes": [{"at": "8.13.0.11", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "Cortex XSOAR", "versions": [{"status": "affected", "version": "8.12.0", "versionType": "custom"}, {"status": "affected", "version": "8.11.0", "versionType": "custom"}, {"status": "affected", "version": "8.10.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.14.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.13.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.12.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xsoar:*:*:*:*:*:Linux:*:*", "versionEndExcluding": "8.13.0.11", "versionStartIncluding": "8.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xsoar:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xsoar:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xsoar:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle (MITM) attack, to write arbitrary files to the host.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p></p>A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle (MITM) attack, to write arbitrary files to the host.<br><p></p>"}]}], "references": [{"url": "https://security.paloaltonetworks.com/CVE-2026-0270", "tags": ["vendor-advisory"]}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4559", "name": "CVE-2007-4559: Python tarfile module path traversal", "tags": ["related", "third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:M/U:Amber"}}], "configurations": [{"lang": "en", "value": "No special configuration is required.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "No special configuration is required."}]}], "workarounds": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of these issues.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Palo Alto Networks is not aware of any malicious exploitation of these issues."}]}], "solutions": [{"lang": "eng", "value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nCortex XSOAR 8.13 on Linux 8.13.0 Upgrade to 8.13.0.11 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<table><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>Cortex XSOAR 8.13 on Linux<br></td>\n <td>8.13.0</td>\n <td>Upgrade to 8.13.0.11 or later.</td>\n </tr></tbody></table>"}]}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}]}], "timeline": [{"time": "2026-06-10T16:00:00.000Z", "lang": "eng", "value": "Initial publication"}], "credits": [{"lang": "en", "value": "Palo Alto Networks thanks the internal security team for discovering and reporting this issue.", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_affectedList": ["Cortex XSOAR 8.13.0"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-0270"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T03:55:34.115Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0270", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-11T13:48:47.539785Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T13:48:51.346Z"}}], "cna": {"title": "Cortex XSOAR: Path Traversal Vulnerability", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Palo Alto Networks thanks the internal security team for discovering and reporting this issue."}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 4.8, "Automatable": "YES", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:M/U:Amber", "exploitMaturity": "UNREPORTED", "providerUrgency": "AMBER", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "Cortex XSOAR", "versions": [{"status": "affected", "changes": [{"at": "8.13.0.11", "status": "unaffected"}], "version": "8.13", "lessThan": "8.13.0.11", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "Cortex XSOAR", "versions": [{"status": "affected", "version": "8.12.0", "versionType": "custom"}, {"status": "affected", "version": "8.11.0", "versionType": "custom"}, {"status": "affected", "version": "8.10.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.14.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.13.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.12.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "base64": false}]}], "timeline": [{"lang": "eng", "time": "2026-06-10T16:00:00.000Z", "value": "Initial publication"}], "solutions": [{"lang": "eng", "value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nCortex XSOAR 8.13 on Linux 8.13.0 Upgrade to 8.13.0.11 or later.", "supportingMedia": [{"type": "text/html", "value": "<table><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>Cortex XSOAR 8.13 on Linux<br></td>\n <td>8.13.0</td>\n <td>Upgrade to 8.13.0.11 or later.</td>\n </tr></tbody></table>", "base64": false}]}], "datePublic": "2026-06-10T16:00:00.000Z", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2026-0270", "tags": ["vendor-advisory"]}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4559", "name": "CVE-2007-4559: Python tarfile module path traversal", "tags": ["related", "third-party-advisory"]}], "workarounds": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of these issues.", "supportingMedia": [{"type": "text/html", "value": "Palo Alto Networks is not aware of any malicious exploitation of these issues.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle (MITM) attack, to write arbitrary files to the host.", "supportingMedia": [{"type": "text/html", "value": "<p></p>A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle (MITM) attack, to write arbitrary files to the host.<br><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "configurations": [{"lang": "en", "value": "No special configuration is required.", "supportingMedia": [{"type": "text/html", "value": "No special configuration is required.", "base64": false}]}], "x_affectedList": ["Cortex XSOAR 8.13.0"], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xsoar:*:*:*:*:*:Linux:*:*", "vulnerable": true, "versionEndExcluding": "8.13.0.11", "versionStartIncluding": "8.13.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xsoar:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "8.12.0"}, {"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xsoar:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "8.11.0"}, {"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xsoar:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "8.10.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-06-10T20:59:00.350Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0270", "state": "PUBLISHED", "dateUpdated": "2026-06-12T03:55:34.115Z", "dateReserved": "2025-11-03T20:44:30.311Z", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "datePublished": "2026-06-10T20:59:00.350Z", "assignerShortName": "palo_alto"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Cortex XSOAR", "vendor": "Palo Alto Networks", "versions": [{"changes": [{"at": "8.13.0.11", "status": "unaffected"}], "lessThan": "8.13.0.11", "status": "affected", "version": "8.13", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Cortex XSOAR", "vendor": "Palo Alto Networks", "versions": [{"status": "affected", "version": "8.12.0", "versionType": "custom"}, {"status": "affected", "version": "8.11.0", "versionType": "custom"}, {"status": "affected", "version": "8.10.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.14.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.13.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.12.0", "versionType": "custom"}]}], "source": "psirt@paloaltonetworks.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:*:*:*:*:*:*:*:*", "matchCriteriaId": "A16792C5-B73E-46EA-8A84-28FFA512DB7A", "versionEndExcluding": "8.13.0.11", "versionStartIncluding": "8.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle (MITM) attack, to write arbitrary files to the host."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta en el software del motor Cortex XSOAR de Palo Alto Networks que se ejecuta en Linux permite a un atacante no autenticado en una red adyacente, con la capacidad de interceptar y manipular el tr\u00e1fico de respuesta de la red a trav\u00e9s de un ataque man-in-the-middle (MitM), escribir archivos arbitrarios en el host."}], "id": "CVE-2026-0270", "lastModified": "2026-07-23T09:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0270", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-11T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-06-10T22:16:53.953", "references": [{"source": "psirt@paloaltonetworks.com", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4559"}, {"source": "psirt@paloaltonetworks.com", "tags": ["Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2026-0270"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "psirt@paloaltonetworks.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[8.13,8.13.0.11)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 97.0, "source": "matching"}]}, "original": {"product": "Cortex XSOAR", "source": "cna", "vendor": "Palo Alto Networks"}, "product": "cortex_xsoar", "vendor": "paloaltonetworks"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.12.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.11.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.10.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.14.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.13.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.12.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 97.0, "source": "matching"}]}, "original": {"product": "Cortex XSOAR", "source": "cna", "vendor": "Palo Alto Networks"}, "product": "cortex_xsoar", "vendor": "paloaltonetworks"}], "created": "2026-06-11T00:00:14.041498+00:00", "updated": "2026-06-11T10:30:11.840720+00:00", "vendors": ["paloaltonetworks", "paloaltonetworks$PRODUCT$cortex_xsoar"]}