CVE-2026-0274

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0274", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2025-11-03T20:44:33.634Z", "datePublished": "2026-06-10T21:02:26.497Z", "dateUpdated": "2026-06-12T03:55:32.986Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-06-10T21:02:26.497Z"}, "title": "Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integration", "datePublic": "2026-06-10T16:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1390", "description": "CWE-1390 Weak Authentication", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-475", "descriptions": [{"lang": "en", "value": "CAPEC-475 Signature Spoofing by Improper Validation"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "Cortex XSIAM CommvaultSecurityIQ Marketplace", "versions": [{"status": "affected", "version": "1.1.0", "lessThan": "1.2.0", "changes": [{"at": "1.2.0", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "Cortex XSOAR CommvaultSecurityIQ Marketplace", "versions": [{"status": "affected", "version": "1.1.0", "lessThan": "1.2.0", "changes": [{"at": "1.2.0", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xsiam_commvaultsecurityiq_marketplace:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.2.0", "versionStartIncluding": "1.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xsoar_commvaultsecurityiq_marketplace:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.2.0", "versionStartIncluding": "1.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "value": "An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources."}]}], "references": [{"url": "https://security.paloaltonetworks.com/CVE-2026-0274", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "RED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Red"}}], "configurations": [{"lang": "eng", "value": "No special configuration is required to be affected by this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "No special configuration is required to be affected by this issue."}]}], "workarounds": [{"lang": "eng", "value": "No known workarounds exist for this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "No known workarounds exist for this issue."}]}], "solutions": [{"lang": "eng", "value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nCortex XSIAM CommvaultSecurityIQ Marketplace 1.1 1.1.0 through 1.1.9 Upgrade to 1.2.0 or later.\nCortex XSOAR CommvaultSecurityIQ Marketplace 1.1 1.1.0 through 1.1.9 Upgrade to 1.2.0 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1<br></td>\n <td>1.1.0 through 1.1.9</td>\n <td>Upgrade to 1.2.0 or later.</td>\n </tr><tr>\n <td>Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1<br></td>\n <td>1.1.0 through 1.1.9</td>\n <td>Upgrade to 1.2.0 or later.</td>\n </tr></tbody></table>"}]}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}]}], "timeline": [{"time": "2026-06-10T16:00:00.000Z", "lang": "en", "value": "Initial Publication."}], "credits": [{"lang": "en", "value": "our internal security research teams", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "x_affectedList": ["Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.0", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.1", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.2", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.3", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.4", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.5", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.6", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.7", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.0", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.1", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.2", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.3", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.4", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.5", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.6", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.7", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.8", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.9"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-0274"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T03:55:32.986Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0274", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-11T13:45:28.414743Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T13:45:34.933Z"}}], "cna": {"title": "Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integration", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "our internal security research teams"}], "impacts": [{"capecId": "CAPEC-475", "descriptions": [{"lang": "en", "value": "CAPEC-475 Signature Spoofing by Improper Validation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 8.1, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Red", "exploitMaturity": "UNREPORTED", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "Cortex XSIAM CommvaultSecurityIQ Marketplace", "versions": [{"status": "affected", "changes": [{"at": "1.2.0", "status": "unaffected"}], "version": "1.1.0", "lessThan": "1.2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "Cortex XSOAR CommvaultSecurityIQ Marketplace", "versions": [{"status": "affected", "changes": [{"at": "1.2.0", "status": "unaffected"}], "version": "1.1.0", "lessThan": "1.2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "base64": false}]}], "timeline": [{"lang": "en", "time": "2026-06-10T16:00:00.000Z", "value": "Initial Publication."}], "solutions": [{"lang": "eng", "value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nCortex XSIAM CommvaultSecurityIQ Marketplace 1.1 1.1.0 through 1.1.9 Upgrade to 1.2.0 or later.\nCortex XSOAR CommvaultSecurityIQ Marketplace 1.1 1.1.0 through 1.1.9 Upgrade to 1.2.0 or later.", "supportingMedia": [{"type": "text/html", "value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1<br></td>\n <td>1.1.0 through 1.1.9</td>\n <td>Upgrade to 1.2.0 or later.</td>\n </tr><tr>\n <td>Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1<br></td>\n <td>1.1.0 through 1.1.9</td>\n <td>Upgrade to 1.2.0 or later.</td>\n </tr></tbody></table>", "base64": false}]}], "datePublic": "2026-06-10T16:00:00.000Z", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2026-0274", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "eng", "value": "No known workarounds exist for this issue.", "supportingMedia": [{"type": "text/html", "value": "No known workarounds exist for this issue.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.", "supportingMedia": [{"type": "text/html", "value": "An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1390", "description": "CWE-1390 Weak Authentication"}]}], "configurations": [{"lang": "eng", "value": "No special configuration is required to be affected by this issue.", "supportingMedia": [{"type": "text/html", "value": "No special configuration is required to be affected by this issue.", "base64": false}]}], "x_affectedList": ["Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.0", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.1", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.2", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.3", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.4", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.5", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.6", "Cortex XSIAM CommvaultSecurityIQ Marketplace 1.1.7", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.0", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.1", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.2", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.3", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.4", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.5", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.6", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.7", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.8", "Cortex XSOAR CommvaultSecurityIQ Marketplace 1.1.9"], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xsiam_commvaultsecurityiq_marketplace:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.2.0", "versionStartIncluding": "1.2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xsoar_commvaultsecurityiq_marketplace:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.2.0", "versionStartIncluding": "1.2.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-06-10T21:02:26.497Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0274", "state": "PUBLISHED", "dateUpdated": "2026-06-12T03:55:32.986Z", "dateReserved": "2025-11-03T20:44:33.634Z", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "datePublished": "2026-06-10T21:02:26.497Z", "assignerShortName": "palo_alto"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Cortex XSIAM CommvaultSecurityIQ Marketplace", "vendor": "Palo Alto Networks", "versions": [{"changes": [{"at": "1.2.0", "status": "unaffected"}], "lessThan": "1.2.0", "status": "affected", "version": "1.1.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Cortex XSOAR CommvaultSecurityIQ Marketplace", "vendor": "Palo Alto Networks", "versions": [{"changes": [{"at": "1.2.0", "status": "unaffected"}], "lessThan": "1.2.0", "status": "affected", "version": "1.1.0", "versionType": "custom"}]}], "source": "psirt@paloaltonetworks.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsiam_commvaultsecurityiq_marketplace:1.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "DD151BA7-879B-4F39-BFAF-9046253FE182", "vulnerable": true}, {"criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar_commvaultsecurityiq_marketplace:1.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "2D8C3692-1612-455C-AF1F-6A697BF07622", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources."}, {"lang": "es", "value": "Una vulnerabilidad de validaci\u00f3n incorrecta de credenciales en la integraci\u00f3n de CommvaultSecurityIQ para Cortex XSOAR y Cortex XSIAM permite a un atacante no autenticado acceder y modificar recursos protegidos."}], "id": "CVE-2026-0274", "lastModified": "2026-07-23T09:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0274", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-11T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-06-10T22:16:55.187", "references": [{"source": "psirt@paloaltonetworks.com", "tags": ["Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2026-0274"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1390"}], "source": "psirt@paloaltonetworks.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.1.0,1.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Cortex XSIAM CommvaultSecurityIQ Marketplace", "source": "cna", "vendor": "Palo Alto Networks"}, "product": "cortex_xsiam_commvaultsecurityiq_marketplace", "vendor": "palo_alto_networks"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.1.0,1.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Cortex XSOAR CommvaultSecurityIQ Marketplace", "source": "cna", "vendor": "Palo Alto Networks"}, "product": "cortex_xsoar_commvaultsecurityiq_marketplace", "vendor": "palo_alto_networks"}], "created": "2026-06-10T23:00:20.843133+00:00", "updated": "2026-08-12T01:15:17.523596+00:00", "vendors": ["palo_alto_networks", "palo_alto_networks$PRODUCT$cortex_xsiam_commvaultsecurityiq_marketplace", "palo_alto_networks$PRODUCT$cortex_xsoar_commvaultsecurityiq_marketplace"]}