Critical severity · published Apr 13, 2026
CVE-2026-0234
Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration
9.1
CVSS
0.2%
EPSS
No
On KEV
Description
An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify protected resources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cortex XSIAM Microsoft Teams Marketplace · Palo Alto Networks
1.5.0 before 1.5.52 · source: vendor
CX
Cortex XSOAR Microsoft Teams Marketplace · Palo Alto Networks
1.5.0 before 1.5.52 · source: vendor
CX
Cortex Xsiam · Paloaltonetworks
1.5.0 before 1.5.52 · source: NVD
CX
Cortex Xsoar · Paloaltonetworks
1.5.0 before 1.5.52 · source: NVD
Affected product
CX
Cortex XSIAM Microsoft Teams Marketplace
Palo Alto Networks