High severity · published Apr 13, 2026
CVE-2026-0233
Autonomous Digital Experience Manager: Improper validation of ADEM certificate
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
A certificate validation vulnerability in Palo Alto Networks Autonomous Digital Experience Manager on Windows allows an unauthenticated attacker with adjacent network access to execute arbitrary code with NT AUTHORITY\SYSTEM privileges.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Autonomous Digital Experience Manager · Palo Alto Networks
5.10.0 before 5.10.14 · source: vendor, NVD
Affected product
AD
Autonomous Digital Experience Manager
Palo Alto Networks