CVE-2025-0134CWE-94

Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM

Medium · published May 14, 2025

CVSS v4.0
6.5
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM.

The record
Technical detail
CVSS v4.0
6.5 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber
EPSS
0.00530 · 44.0th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-05-14T18:07Z
EPSS history
Timeline
  • 14 MAY 18:07Z
    Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM
    cvelistv5