CVE-2026-0238

Vulnerability

Overview

CVE-2026-0238 is an improper input validation vulnerability (CWE-20) in Palo Alto Networks Broker VM. An authenticated administrator can inject arbitrary content into certain Broker VM fields, specifically certificate and key fields, due to insufficient validation of user-supplied input [1].

Exploitation

To exploit this vulnerability, an attacker must have administrative privileges on the Broker VM. The attack vector is local, with low attack complexity and no user interaction required. The attacker can inject arbitrary content into the affected fields, potentially leading to integrity impacts on the system [1].

Impact

Successful exploitation allows an authenticated administrator to compromise the integrity of Broker VM certificate and key fields. The CVSS v4.0 base score is 4.8 (Low), with low integrity impacts to both the vulnerable system and subsequent systems. No confidentiality or availability impacts are expected [1].

Mitigation

Palo Alto Networks has released a fix in Broker VM version 30.0.24. All versions prior to 30.0.24 are affected. No workarounds are available, and mitigations are available. The vulnerability was discovered internally, and no malicious exploitation has been reported [1].