Is CVE-2026-0276 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0276 being exploited in the wild.

How severe is CVE-2026-0276?

Informational severity, with a CVSS score of 4.8, published 9 July 2026.

Which products and versions are affected?

Palo Alto Networks Cortex XDR Broker VM 20.0.96 to 31.0.58.

Is there a fix for CVE-2026-0276?

A patch was published on 2026-07-08: Fixed in version 31.0.58. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-0276 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-0276?

Check whether you run Palo Alto Networks Cortex XDR Broker VM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0276: Palo Alto Networks Cortex XDR Broker VM privilege escalation

CVE-2026-0276 · Severity: info · CVSS 4.8 · Published 2026-07-09

A security vulnerability in the Palo Alto Networks Cortex XDR Broker VM allows a user who already has local access to the system to gain full administrative (root) control. The Broker VM is a component used to bridge communication between security agents and the management console. If exploited, an attacker could bypass security controls, access sensitive configuration data, or disrupt the monitoring of the corporate network.

Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0276 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0276 being exploited in the wild.
How severe is CVE-2026-0276?: Informational severity, with a CVSS score of 4.8, published 9 July 2026.
Which products and versions are affected?: Palo Alto Networks Cortex XDR Broker VM 20.0.96 to 31.0.58.
Is there a fix for CVE-2026-0276?: A patch was published on 2026-07-08: Fixed in version 31.0.58. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0276 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-0276?: Check whether you run Palo Alto Networks Cortex XDR Broker VM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper privilege management vulnerability (CWE-269) exists in the Palo Alto Networks Cortex XDR Broker VM. The flaw allows a locally authenticated user with low privileges to execute commands or perform actions with root-level permissions. The vulnerability is present in versions starting from 20.0.96 and is fixed in version 31.0.58. Exploitation requires local access to the VM but does not require high complexity or user interaction. Successful exploitation results in a complete compromise of the Broker VM's integrity and confidentiality.

Affected products

Palo Alto Networks Cortex XDR Broker VM 20.0.96 to 31.0.58

Timeline

2026-07-08: disclosed: Initial discovery and publication by Palo Alto Networks.
2026-07-08: patched: Fixed in version 31.0.58.
2026-07-09: advisory: NVD record published.

References

https://security.paloaltonetworks.com/CVE-2026-0276

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.