Vulnerability · Published May 13, 2026 · Assigned by palo_alto

CVE-2026-0240Trust Protection Foundation: Sensitive Information Disclosure Vulnerability

Medium 4.5

In plain English

A medium-severity security flaw in Trust Protection Foundation from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 4.0)4.5Medium

Exploit odds (30 days)0.2%top 84.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	Trust Protection Foundation	25.3.0 – before 25.3.325.1.0 – before 25.1.824.3.0 – before 24.3.624.1.0 – before 24.1.13

Weakness: CWE-497 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

References

https://security.paloaltonetworks.com/CVE-2026-0240 vendor-advisory