CVEvulnerability

CVE-2026-0234

7.2 HIGH Published 2026-04-13 Modified 2026-10-26 Official page ↗
Status
Undergoing Analysis
Published
2026-04-13
Last modified
2026-10-26
Assigner
[email protected]
CVSS 4.0 ([email protected])
7.2 HIGH — CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-347

Description

An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify protected resources.

Affected configurations

• paloaltonetworks cortex xsiam (>= 1.5.0 < 1.5.52) • paloaltonetworks cortex xsoar (>= 1.5.0 < 1.5.52)

Related

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References