Loading vulnerability…
Information disclosure in Palo Alto Networks Cortex XDR Broker VM live terminal session
CVE-2026-0231 is an information disclosure vulnerability in Palo Alto Networks Cortex XDR Broker VM. According to the provided content, an authenticated user can obtain and modify sensitive information by triggering a live terminal session through the Cortex UI and then modifying configuration settings. Exploitation requires network access to the Broker VM. The issue affects Cortex XDR Broker VM 30.0.0 versions prior to 30.0.49.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to access sensitive information exposed through the vulnerable workflow and to modify configuration settings on the Broker VM. This can compromise the confidentiality of sensitive data and the integrity of system configuration, potentially enabling further operational disruption or weakening of security controls within the affected deployment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network access to the Broker VM to only trusted administrative hosts and users, minimize the number of accounts permitted to authenticate to the Cortex UI, and closely monitor use of live terminal session functionality and configuration changes for anomalous activity. Apply vendor-recommended mitigations from the Palo Alto Networks advisory until the fixed version can be deployed.
Patch, then assume compromise.
Upgrade Palo Alto Networks Cortex XDR Broker VM to a remediated release. Based on the provided content, affected versions are Cortex XDR Broker VM 30.0.0 prior to 30.0.49; users should update to version 30.0.49 or later and review the relevant Palo Alto Networks security advisory for any product-specific upgrade guidance.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.