Medium severity · published Aug 13, 2025
CVE-2025-2184
Cortex XDR Broker VM: Secrets Shared Across Multiple Broker VM Images
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal services. Users knowing these default credentials could access internal services on other Broker VM installations.
The attacker must have network access to the Broker VM to exploit this issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cortex XDR Broker VM · Palo Alto Networks
28.0.0 before 28.0.52 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2184
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2184
security.paloaltonetworks.com
https://security.paloaltonetworks.com/CVE-2025-2184
More from Cortex XDR Broker VM
7.8
CVE-2026-0276
Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
6.3
CVE-2025-0119
Cortex XDR Broker VM: Authenticated Command Injection Vulnerability in Broker VM
5.7
CVE-2026-0231
Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability
5.3
CVE-2025-0113
Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containers
4.8
CVE-2026-0304
Cortex XDR Broker VM: Privilege Escalation Vulnerability