# CVE-2026-0234: Palo Alto Networks Cortex XSOAR signature bypass in Microsoft Teams integration

Source: https://junglewise.ai/threats/cve-2026-0234-palo-alto-networks-cortex-xsoar-signature-bypass-in-microsoft  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-0234 · Severity: critical · CVSS 9.1 · Published 2026-04-13

A security vulnerability exists in the Microsoft Teams integration for Palo Alto Networks Cortex XSOAR and XSIAM, which are platforms used by organizations to manage and automate security operations. This flaw allows an unauthorized person to bypass security checks and potentially access or modify sensitive internal resources. If exploited, an attacker could interfere with security workflows or gain access to protected data without needing a password or internal account.

Vendors: [Palo Alto Networks](https://junglewise.ai/threats/vendors/palo-alto-networks), [Paloaltonetworks](https://junglewise.ai/threats/vendors/paloaltonetworks).

## Quick answers

**Is CVE-2026-0234 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0234 being exploited in the wild.

**How severe is CVE-2026-0234?** Critical severity, with a CVSS score of 9.1, published 13 April 2026.

**Which products and versions are affected?** Palo Alto Networks Cortex XSIAM Microsoft Teams Marketplace integration 1.5.0 through 1.5.51; Palo Alto Networks Cortex XSOAR Microsoft Teams Marketplace integration 1.5.0 through 1.5.51.

**Is there a fix for CVE-2026-0234?** A patch was published on 2026-04-08: Version 1.5.52 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0234 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-0234?** Check whether you run Palo Alto Networks Cortex XSIAM Microsoft Teams Marketplace integration, Palo Alto Networks Cortex XSOAR Microsoft Teams Marketplace integration, Paloaltonetworks Cortex Xsiam or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability (CWE-347) stems from improper verification of cryptographic signatures within the Microsoft Teams Marketplace integration for Cortex XSOAR and XSIAM. An unauthenticated remote attacker can exploit this flaw to bypass authentication mechanisms and perform unauthorized actions on protected resources. The root cause is a failure to correctly validate the authenticity of incoming requests or tokens from the Teams integration. While some CVSS 4.0 assessments suggest high complexity, the NVD CVSS 3.1 score of 9.1 reflects a critical impact on confidentiality and integrity. Users are advised to upgrade the Microsoft Teams Marketplace integration to version 1.5.52 or later.

## Affected products

- Palo Alto Networks Cortex XSOAR Microsoft Teams Marketplace integration 1.5.0 through 1.5.51
- Palo Alto Networks Cortex XSIAM Microsoft Teams Marketplace integration 1.5.0 through 1.5.51

## Timeline

- 2026-04-08: disclosed: Initial publication by Palo Alto Networks
- 2026-04-08: patched: Version 1.5.52 released to address the issue
- 2026-04-13: advisory: NVD publication date

## References

- [https://security.paloaltonetworks.com/CVE-2026-0234](https://security.paloaltonetworks.com/CVE-2026-0234)