What’s Vulnerable › Vulnerabilities
CVE-2026-0234: Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-13 · updated 2026-10-26
- Weakness: CWE-347
Description
An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify protected resources.
Affected products
- Paloaltonetworks Cortex Xsiam: from 1.5.0 before 1.5.52 — fixed in 1.5.52
- Palo Alto Networks Cortex XSOAR: from 1.5.0 before 1.5.52 — fixed in 1.5.52
- Palo Alto Networks Cortex XSIAM Microsoft Teams Marketplace: from 1.5.0 before 1.5.52 — fixed in 1.5.52
- Palo Alto Networks Cortex XSOAR Microsoft Teams Marketplace: from 1.5.0 before 1.5.52 — fixed in 1.5.52
How to fix
Upgrade to a fixed version: Paloaltonetworks Cortex Xsiam 1.5.52; Palo Alto Networks Cortex XSOAR 1.5.52; Palo Alto Networks Cortex XSIAM Microsoft Teams Marketplace 1.5.52; Palo Alto Networks Cortex XSOAR Microsoft Teams Marketplace 1.5.52. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-0234 or the next vulnerability affects your stack