CVE-2025-4228
Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
Severity
Medium 4.6
CVSS 4.0
Exploited
Not listed
EPSS
0.002
7.8th percentile
Discovered by
Vendor
Published by the vendor
Published
Jun 12, 2025
Assigned by palo_alto
Description
An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.
Weakness: CWE-266
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | Cortex XDR | Endpoint / EDR | cna-assigner |
Vendor-reported affected versions (1)
- Palo Alto Networks · Cortex XDR Broker VM
Credit
This issue was discovered during an internal penetration test
Vendor remediation
This issue is fixed in Cortex XDR Broker VM 27.0.26, and all later Cortex XDR Broker VM versions. * If you enabled automatic upgrades for Broker VM, then no action is required at this time. * If you did not enable automatic upgrades, then we recommend that you do so for Broker VM to ensure that you always have the latest security patches installed in your software.