Medium severity · published May 14, 2025
CVE-2025-0132
Cortex XDR Broker VM: Unauthenticated User Can Disable Internal Services
6.9
CVSS
0.5%
EPSS
No
On KEV
Description
A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM.
The attacker must have network access to the Broker VM to exploit this issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cortex XDR Broker VM · Palo Alto Networks
26.0.0 before 26.0.119 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0132
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0132
security.paloaltonetworks.com
https://security.paloaltonetworks.com/CVE-2025-0132
More from Cortex XDR Broker VM
7.8
CVE-2026-0276
Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
6.5
CVE-2025-0134
Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM