CVE-2026-0242

MediumCVSS 6.1/10Last modified Oct 26, 2026

Description

A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform.

Metrics

CVSS 4.0 6.1/10CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Palo Alto NetworksTrust Protection Foundation>= 25.3.0, < 25.3.3; >= 25.1.0, < 25.1.8; >= 24.3.0, < 24.3.6; >= 24.1.0, < 24.1.13

References

Timeline

Published
May 13, 2026
Last modified
Oct 26, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-02436.5A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attacker in a network adjCVE-2026-02448.1An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to imCVE-2026-02455.5Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and credenCVE-2026-02467.8A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-admCVE-2026-02477.8Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentCVE-2026-02485.9An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-CVE-2026-02496.5Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encryCVE-2026-02508.1A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt sysCVE-2026-02517.8Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privilCVE-2026-02564.8A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to CVE-2026-02579.1Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to CVE-2026-02589.1A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthentica
CVE-2026-0242: Medium severity, CVSS 6.1 | Vulnix