Vulnerability · Published Apr 11, 2025 · Assigned by palo_alto
CVE-2025-0119Cortex XDR Broker VM: Authenticated Command Injection Vulnerability in Broker VM
Medium 6.3
In plain English
A medium-severity OS command injection in Cortex XDR Broker VM from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.6%top 52.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS commands with root privileges on the host operating system running Broker VM.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | Cortex XDR Broker VM | 1.0.0 – before 26.100.3 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/AU:N/R:U/V:D/RE:M/U:Amber
References
- https://security.paloaltonetworks.com/CVE-2025-0119 vendor-advisory