CVE-2026-0274

CriticalCVSS 9.1/10Last modified Jul 23, 2026

Description

An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-1390

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Palo Alto Networks	Cortex XSIAM CommvaultSecurityIQ Marketplace	>= 1.1.0, < 1.2.0
Palo Alto Networks	Cortex XSOAR CommvaultSecurityIQ Marketplace	>= 1.1.0, < 1.2.0

References

https://security.paloaltonetworks.com/CVE-2026-0274Vendor Advisory

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-02756.7A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to CVE-2026-02767.8A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as CVE-2026-02775.9An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (Mit CVE-2026-02787.8Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to byp CVE-2026-02796.1Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/por CVE-2026-02807.2An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypas CVE-2026-02817.1An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to th CVE-2026-02826.5A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the manageme CVE-2026-02837.2An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker wi CVE-2026-02849.9An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticate CVE-2026-02854.9A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network CVE-2026-02867.2A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to e