CVE-2025-0113
Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containers
Severity
Medium 5.3
CVSS 4.0
Exploited
Not listed
EPSS
0.003
17.4th percentile
Discovered by
Third party
Published by the vendor
Published
Feb 12, 2025
Assigned by palo_alto
Description
A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs transmitted by the Cortex XDR Agent to the Cortex XDR server.
Weakness: CWE-424
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | Cortex XDR | Endpoint / EDR | cna-assigner |
Vendor-reported affected versions (1)
- Palo Alto Networks · Cortex XDR Broker VM
Credit
Julian Imper at Netcloud AG
Vendor remediation
This issue is fixed in Broker VM 26.0.116, and all later Broker VM versions. If you have enabled automatic upgrades for Broker VM, no action is needed. If you do not, we recommend that you enable automatic upgrades for Broker VM to ensure that you always have the latest security patches installed.