Quick answers
- Is CVE-2026-0304 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-0304 being exploited in the wild.
- How severe is CVE-2026-0304?
- Informational severity, with a CVSS score of 4.8, published 10 September 2026.
- Which products and versions are affected?
- Palo Alto Networks Cortex XDR Broker VM 20.0.96 through 32.0.51.
- Is there a fix for CVE-2026-0304?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-0304 attacked?
- It is attacked from the adjacent network.
- Am I affected by CVE-2026-0304?
- Check whether you run Palo Alto Networks Cortex XDR Broker VM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is an argument injection flaw (CWE-88) in the Cortex XDR Broker VM that allows privilege escalation from a low-privileged authenticated user to root. The attack requires man-in-the-middle (MitM) access on the network (adjacent attack vector) and is triggered during cloud-delivered mount actions. An attacker must be authenticated and able to intercept traffic to inject malicious arguments into commands executed by the Broker VM, achieving code execution with root privileges. The vulnerability affects Cortex XDR Broker VM versions 32.0.0 through 32.0.51 and is fixed in version 32.0.52 and later. Palo Alto Networks is unaware of active exploitation in the wild.
Affected products
- Palo Alto Networks Cortex XDR Broker VM 20.0.96 through 32.0.51
Timeline
- 2026-09-09: disclosed