CVE-2025-0112

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activit...

CVE-2025-0112

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activit...

CVE-2025-0112 Cortex XDR Agent: Local Windows User Can Disable the Agent

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activit...

CVE-2025-0112

CVE-2025-0112 (Cortex XDR Agent, Windows): A defect in the agent’s detection mechanism allows a non-administrative Windows user to disable the Cortex XDR agent, and could be abused by malware to disable it before performing malicious activity. The available documents describe the affected softwar...

CVE-2025-0112 Cortex XDR Agent: Local Windows User Can Disable the Agent

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activit...

CVE-2025-0113

A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs transmitted by the Cortex XDR Agent to th...

CVE-2025-0113

A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs transmitted by the Cortex XDR Agent to th...

CVE-2025-0113 Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containers

A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs transmitted by the Cortex XDR Agent to th...

CVE-2025-0113

Summary: CVE-2025-0113 concerns the Palo Alto Networks Cortex XDR Broker VM where a flaw in the network isolation mechanism can let an attacker access Docker containers from the Broker VM’s host network, potentially reading analysis data and Cortex XDR logs. Affected component: Cortex XDR Broker ...

CVE-2025-0113 Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containers

A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs transmitted by the Cortex XDR Agent to th...

Impact of CVE-2024-1135

The Palo Alto Networks Product Security Assurance team has evaluated CVE-2024-1135 as it applies to our products. The Broker VM used in following products is vulnerable to CVE-2024-1135: Cortex XDR Cortex XSIAM Work around: No workaround or mitigation is available...

Cortex XDR Agent: Local Windows User Can Disable the Agent

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activit...

Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containers

A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs transmitted by the Cortex XDR Agent to th...

Palo Alto Networks Cortex XDR Broker VM 安全漏洞

Palo Alto Networks Cortex XDR Broker VM is a secure virtual machine from Palo Alto Networks, Inc. that integrates with Cortex XDR to bridge the network and Cortex XDR. A security vulnerability exists in Palo Alto Networks Cortex XDR Broker VM prior to version 26.0.116, which stems from the presen...

PT-2025-6777 · Palo Alto Networks · Palo Alto Networks Cortex Xdr Broker Vm

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Cortex XDR Broker VM affected versions not specified Description: A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from...

PT-2025-7456 · Palo Alto Networks · Palo Alto Networks Cortex Xdr Agent

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Cortex XDR agent affected versions not specified Description: A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to...

Native Sensors vs. Integrations for XDR Platforms?

Native sensors vs. integrations in XDR: Native sensors offer faster deployment, real-time detection, and deeper visibility, while integrations may add complexity and delays. Learn how to optimize your XDR strategy for improved security...

Future of Cybersecurity: Will XDR Reshape SIEM & SOAR?

XDR is reshaping cybersecurity by unifying and enhancing SIEM and SOAR capabilities into a single platform. It addresses alert fatigue, improves incident correlation, simplifies operations, and enhances efficiency for SOC teams...

Future of Cybersecurity: Will XDR Absorb SIEM & SOAR?

XDR is reshaping cybersecurity by unifying and enhancing SIEM and SOAR capabilities into a single platform. It addresses alert fatigue, improves incident correlation, simplifies operations, and enhances efficiency for SOC teams...

Lumma Stealer’s GitHub-Based Delivery Explored via Managed Detection and Response

The Managed XDR team investigated a sophisticated campaign distributing Lumma Stealer through GitHub, where attackers leveraged the platform's release infrastructure to deliver malware such as SectopRAT, Vidar, and Cobeacon...