CVE-2026-0276
Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
Severity
Low 1.1
CVSS 4.0
Exploited
Not listed
EPSS
0.001
0.9th percentile
Discovered by
Third party
Published by the vendor
Published
Jul 9, 2026
Assigned by palo_alto
Description
A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user.
Weakness: CWE-269
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | Cortex XDR | Endpoint / EDR | cna-assigner |
Vendor-reported affected versions (1)
- Palo Alto Networks · Cortex XDR Broker VM
Credit
Palo Alto Networks thanks Martin Rougeron for discovering and reporting this issue
Vendor remediation
This issue is fixed in Cortex XDR Broker VM 31.0.58, and all later Cortex XDR Broker VM versions. * If automatic upgrades are enabled for Broker VM, then no action is required at this time. * If automatic upgrades are not enabled for Broker VM, then we recommend that you do so to ensure that you always have the latest security patches installed in your software.