CVE-2025-0134 MEDIUM

CVE-2025-0134: Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM

Vendor Palo Alto Networks
Product Cortex XDR Broker VM
Weakness CWE-94 · Code injection
Published May 14, 2025
Last update February 26, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber

What the vulnerability does

01Description

A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM.

Key dates

02Disclosure timeline

May 14, 2025 CVE published
February 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-3641 Moodle: authenticated remote code execution risk in the moodle lms dropbox repository CVE-2026-39440 WordPress FunnelFormsPro plugin <= 3.8.1 - Remote Code Execution (RCE) vulnerability CVE-2024-11600 Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.0 - Authenticated (Administrator+) Remote Code Execution CVE-2018-25357 Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php CVE-2025-26621 OpenCTI vulnerable to Denial of Service through web hook