Vulnerability · Published Apr 13, 2026 · Assigned by palo_alto
CVE-2026-0234Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration
High 7.2
In plain English
A high-severity security flaw in Cortex XSIAM Microsoft Teams Marketplace from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 4.0)7.2High
Exploit odds (30 days)0.2%top 85.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify protected resources.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | Cortex XSOAR Microsoft Teams Marketplace | 1.5.0 – before 1.5.52 |
| Palo Alto Networks | Cortex XSIAM Microsoft Teams Marketplace | 1.5.0 – before 1.5.52 |
Weakness: CWE-347 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Red
References
- https://security.paloaltonetworks.com/CVE-2026-0234 vendor-advisory