CVE-2026-0270

HighCVSS 7.5/10Last modified Jul 23, 2026

Description

A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle (MITM) attack, to write arbitrary files to the host.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Palo Alto Networks	Cortex XSOAR	>= 8.13, < 8.13.0.11
Palo Alto Networks	Cortex XSOAR	8.12.0; 8.11.0; 8.10.0

References

https://nvd.nist.gov/vuln/detail/CVE-2007-4559Third Party Advisory, US Government Resource
https://security.paloaltonetworks.com/CVE-2026-0270Vendor Advisory

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-02717.8A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma Access Agent app on Linux devices enables a local user to execute CVE-2026-02727.2A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command CVE-2026-02737.2A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restriction CVE-2026-02749.1An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unaut CVE-2026-02756.7A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to CVE-2026-02767.8A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as CVE-2026-02775.9An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (Mit CVE-2026-02787.8Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to byp CVE-2026-02796.1Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/por CVE-2026-02807.2An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypas CVE-2026-02817.1An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to th CVE-2026-02826.5A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the manageme