This vulnerability (CVE-2026-0270) involves improper limitation of a pathname to a restricted directory (CWE-22) in Palo Alto Networks Cortex XSOAR engine software on Linux. An attacker positioned on an adjacent network can perform a man-in-the-middle attack to intercept and manipulate network response traffic, enabling them to write arbitrary files to the host system. The issue affects Cortex XSOAR version 8.13. The vulnerability has a CVSS 4.8 score, reflecting medium severity. No vendor advisory or patch is currently available, and no known exploits have been reported.

An unauthenticated attacker on an adjacent network can exploit this vulnerability to write arbitrary files to the host running Cortex XSOAR 8.13 by manipulating intercepted network traffic. This could lead to unauthorized modification of files on the system, potentially impacting system integrity. However, exploitation requires network adjacency and a man-in-the-middle position, and the overall severity is rated medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor Palo Alto Networks advisories for updates. Until a patch is available, limit network exposure of Cortex XSOAR instances and restrict network access to trusted sources to reduce the risk of man-in-the-middle attacks.