CVE-2026-0233

HighCVSS 8.8/10Last modified Oct 26, 2026

Description

A certificate validation vulnerability in Palo Alto Networks Autonomous Digital Experience Manager on Windows allows an unauthenticated attacker with adjacent network access to execute arbitrary code with NT AUTHORITY\SYSTEM privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Palo Alto Networks	Autonomous Digital Experience Manager	>= 5.10.0, < 5.10.14

References

https://security.paloaltonetworks.com/CVE-2026-0233Vendor Advisory

Timeline

Published: Apr 13, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-02349.1An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Mi CVE-2026-02354.7A race condition vulnerability in Palo Alto Networks Prisma® Browser enables a locally authenticated non-admin user to bypass certain access CVE-2026-02367.8A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface CVE-2026-02377.8An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to a CVE-2026-02383.2A vulnerability in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into certain Broker VM fie CVE-2026-02396.5An information disclosure vulnerability in the Chronosphere Chronocollector enables an unauthenticated attacker with network access to the c CVE-2026-02408.7An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information fro CVE-2026-02417.2Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized ac CVE-2026-02426.1A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the CVE-2026-02436.5A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attacker in a network adj CVE-2026-02448.1An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to im CVE-2026-02455.5Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and creden