CVE-2025-4228: Palo Alto Networks Cortex Xdr Broker Vm

Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days.

An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.

Affected products

• Palo Alto Networks Cortex Xdr Broker Vm: from 27.0.0, before 27.0.26 (fixed in 27.0.26)

Published 2025-06-13. Last modified 2026-06-17.