CVE-2025-4228: Palo Alto Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
This Palo Alto advisory covers CVE-2025-4228 in Cortex XDR.
- CVE-2025-4228
Key facts
- Vendor rating
- Medium, CVSS 4.6
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Cortex XDR Broker VM < 27.0.26
- Fixed in
- Cortex XDR Broker VM >= 27.0.26
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.
Text from the source record.
- Cortex XDR Broker VM < 27.0.26
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2025-4228
Upgrade to a fixed release named by Palo Alto:
- Cortex XDR Broker VM >= 27.0.26
Vendor guidance
- This issue is fixed in Cortex XDR Broker VM 27.0.26, and all later Cortex XDR Broker VM versions.
- If you enabled automatic upgrades for Broker VM, then no action is required at this time.
- If you did not enable automatic upgrades, then we recommend that you do so for Broker VM to ensure that you always have the latest security patches installed in your software.
Workaround status
- No known workarounds or mitigations exist for this issue.
More Palo Alto Networks advisories
CVE-2026-0231Mar 11, 2026information disclosure vulnerability in Palo Alto Networks Cortex XDR® Broker VMCVE-2026-0230Mar 11, 2026problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOSCVE-2025-4234Sep 12, 2025Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of CredentialsCVE-2026-111497Oct 26, 2026Portfolio Status: Impact of Brotli Vulnerability on Palo Alto Networks ProductsCVE-2026-109618Oct 21, 2026Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo AltoCVE-2026-0317Oct 14, 2026PAN-OS: Denial of Service Vulnerability
Palo Alto Networks advisories, June 2025All Palo Alto Networks advisories
Get an email when Palo Alto Cortex publishes the next one.
See Palo Alto Cortex's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Palo Alto Networks CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
