Cortex XDR
CVE-2026-0304: Privilege Escalation Vulnerability
A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Cortex XDR Broker VM 20.0 | 32.0.52 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.
Am I affected?
No special configuration is required to be affected by this issue on brokers that process cloud-delivered mount actions.
Workarounds
No known workarounds exist for this issue.
Exploitation
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.