CVEvulnerability

CVE-2026-0240

4.5 MEDIUM Published 2026-05-13 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-05-13
Last modified
2026-10-26
Assigner
[email protected]
CVSS 4.0 ([email protected])
4.5 MEDIUM — CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
CVSS 3.1 ([email protected])
8.7 HIGH — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-497

Description

An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.

Affected configurations

• paloaltonetworks trust protection foundation (>= 24.1.0 < 24.1.13) • paloaltonetworks trust protection foundation (>= 24.3.0 < 24.3.6) • paloaltonetworks trust protection foundation (>= 25.1.0 < 25.1.8) • paloaltonetworks trust protection foundation (>= 25.3.0 < 25.3.3)

Related

Weakness · CWE (1)

  • CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere weakness

References