Medium severity · published Jun 12, 2025
CVE-2025-4228
Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cortex XDR Broker VM · Palo Alto Networks
27.0.0 before 27.0.26 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4228
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4228
security.paloaltonetworks.com
https://security.paloaltonetworks.com/CVE-2025-4228
More from Cortex XDR Broker VM
7.8
CVE-2026-0276
Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
6.3
CVE-2025-0119
Cortex XDR Broker VM: Authenticated Command Injection Vulnerability in Broker VM
5.7
CVE-2026-0231
Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability
5.3
CVE-2025-2184
Cortex XDR Broker VM: Secrets Shared Across Multiple Broker VM Images
5.3
CVE-2025-0113
Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containers