This vulnerability (CVE-2026-0304) affects Palo Alto Networks Cortex XDR Broker VM and involves privilege escalation. An authenticated user with low privileges who can perform a man-in-the-middle attack can exploit this flaw to execute arbitrary code with root privileges on the Broker VM. The vulnerability is categorized under CWE-88 (Improper Neutralization of Argument Delimiters in a Command). The CVSS 4.0 vector indicates attack complexity is low, privileges required are low, and user interaction is not required, with high impact on confidentiality, integrity, and availability. No patch or remediation details are provided in the source data.

Successful exploitation allows an authenticated low privileged user with MitM capabilities to gain root-level code execution on the Broker VM, potentially compromising the entire system. This could lead to full control over the affected VM and its operations. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit authenticated user access and monitor for suspicious MitM activity. Follow Palo Alto Networks' official advisories for updates.