What’s Vulnerable › Vulnerabilities
CVE-2025-2184: Cortex XDR Broker VM: Secrets Shared Across Multiple Broker VM Images
- Severity: medium (CVSS 5.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-08-13 · updated 2026-06-17
- Weakness: CWE-1392
Description
A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal services. Users knowing these default credentials could access internal services on other Broker VM installations. The attacker must have network access to the Broker VM to exploit this issue.
Affected products
- Palo Alto Networks Cortex XDR Broker VM: from 28.0.0 before 28.0.52 — fixed in 28.0.52
How to fix
Upgrade to a fixed version: Palo Alto Networks Cortex XDR Broker VM 28.0.52. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-2184 or the next vulnerability affects your stack