{"id":"CVE-2025-0132","state":"PUBLISHED","title":"Cortex XDR Broker VM: Unauthenticated User Can Disable Internal Services","description":"A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM. \n\nThe attacker must have network access to the Broker VM to exploit this issue.","publishedAt":"2025-05-14T18:07:15.351Z","updatedAt":"2025-05-14T20:51:36.216Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:M/U:Amber","source":"palo_alto"},"assigner":"palo_alto","products":["Palo Alto Networks Cortex XDR Broker VM"],"affected":[{"vendor":"Palo Alto Networks","product":"Cortex XDR Broker VM","defaultStatus":"unaffected","versions":[{"version":"26.0.0","status":"affected","lessThan":"26.0.119","changes":[{"at":"26.0.119","status":"unaffected"}],"versionType":"custom"}],"cpes":["cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.10:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.3:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.119:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.116:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.100.4:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.0.44:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.100.4:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.4.7:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.2.8:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.5.1:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.100.2:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.35:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.33:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.35:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.32:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:21.5.4:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:20.9.1:*:*:*:*:*:*:*"]}],"references":["https://security.paloaltonetworks.com/CVE-2025-0132"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/0xxx/CVE-2025-0132.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-0132","state":"PUBLISHED","datePublished":"2025-05-14T18:07:15.351Z","dateUpdated":"2025-05-14T20:51:36.216Z","assignerShortName":"palo_alto","assignerOrgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","dateReserved":"2024-12-20T23:23:32.897Z"},"containers":{"cna":{"title":"Cortex XDR Broker VM: Unauthenticated User Can Disable Internal Services","descriptions":[{"lang":"en","value":"A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM. \n\nThe attacker must have network access to the Broker VM to exploit this issue."}],"affected":[{"vendor":"Palo Alto Networks","product":"Cortex XDR Broker VM","defaultStatus":"unaffected","versions":[{"version":"26.0.0","status":"affected","lessThan":"26.0.119","changes":[{"at":"26.0.119","status":"unaffected"}],"versionType":"custom"}],"cpes":["cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.10:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.100.3:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.119:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:26.0.116:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.100.4:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:25.0.44:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.100.4:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.4.7:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.2.8:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:24.5.1:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.100.2:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.35:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:23.0.33:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.35:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:22.0.32:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:21.5.4:*:*:*:*:*:*:*","cpe:2.3:a:paloaltonetworks:cortex_xdr_broker_vm:20.9.1:*:*:*:*:*:*:*"]}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2025-0132","tags":["vendor-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"YES","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"MODERATE"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"palo_alto","orgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","dateUpdated":"2025-05-14T18:07:15.351Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"No special configuration is required to be affected by this issue."}],"value":"No special configuration is required to be affected by this issue."}],"credits":[{"lang":"en","type":"finder","value":"Bartosz Chałek"},{"lang":"en","type":"finder","value":"Piotr Kozowicz of CERT Team of ING Bank Slaski"}],"datePublic":"2025-05-14T16:00:00.000Z","exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Palo Alto Networks is not aware of any malicious exploitation of this issue."}],"value":"Palo Alto Networks is not aware of any malicious exploitation of this issue."}],"impacts":[{"capecId":"CAPEC-36","descriptions":[{"lang":"en","value":"CAPEC-36 Using Unpublished APIs"}]}],"solutions":[{"lang":"eng","supportingMedia":[{"base64":false,"type":"text/html","value":"This issue is fixed in Cortex XDR Broker VM 26.0.119, and all later Cortex XDR Broker VM versions.<br><ul><li>If you enabled automatic upgrades for Broker VM, then no action is required at this time.&nbsp;</li><li>If you did not enable automatic upgrades, then we recommend that you do so for Broker VM to ensure that you always have the latest security patches installed in your software.</li></ul>"}],"value":"This issue is fixed in Cortex XDR Broker VM 26.0.119, and all later Cortex XDR Broker VM versions.\n  *  If you enabled automatic upgrades for Broker VM, then no action is required at this time. \n  *  If you did not enable automatic upgrades, then we recommend that you do so for Broker VM to ensure that you always have the latest security patches installed in your software."}],"source":{"defect":["CRTX-147815"],"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2025-05-14T16:00:00.000Z","value":"Initial Publication"}],"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"No known workarounds or mitigations exist for this issue."}],"value":"No known workarounds or mitigations exist for this issue."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-14T20:51:30.365291Z","id":"CVE-2025-0132","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-14T20:51:36.216Z"}}]}}}