by Kastro
Paper/Archive/CVE-2026-0234

CVE-2026-0234

Palo Alto Networks Cortex XSOAR Microsoft Teams Marketplace — Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
30
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 14.0.140 × 202.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify protected resources.

Affected

ProductAffectedFixed inSource
Cortex XSOAR Microsoft Teams Marketplace1.5.0 – < 1.5.521.5.52CNA
Cortex XSIAM Microsoft Teams Marketplace1.5.0 – < 1.5.521.5.52CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
palo_alto (CNA)7.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Red
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorysecurity.paloaltonetworks.com/CVE-2026-0234