Medium severity · published Feb 12, 2025
CVE-2025-0113
Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containers
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs transmitted by the Cortex XDR Agent to the Cortex XDR server.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cortex XDR Broker VM · Palo Alto Networks
1.0.0 before 26.0.116 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0113
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0113
security.paloaltonetworks.com
https://security.paloaltonetworks.com/CVE-2025-0113
More from Cortex XDR Broker VM
7.8
CVE-2026-0276
Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
6.3
CVE-2025-0119
Cortex XDR Broker VM: Authenticated Command Injection Vulnerability in Broker VM
5.7
CVE-2026-0231
Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability
5.3
CVE-2025-2184
Cortex XDR Broker VM: Secrets Shared Across Multiple Broker VM Images
4.8
CVE-2026-0304
Cortex XDR Broker VM: Privilege Escalation Vulnerability