Paper/Archive/CVE-2026-0274

CVE-2026-0274

Palo Alto Networks Cortex XSIAM CommvaultSecurityIQ Marketplace — Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integration

EPSS 0.3%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 21.1.211 × 204.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.

Affected

ProductAffectedFixed inSource

Cortex XSIAM CommvaultSecurityIQ Marketplace1.1.0 – < 1.2.01.2.0CNA

Cortex XSOAR CommvaultSecurityIQ Marketplace1.1.0 – < 1.2.01.2.0CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

palo_alto (CNA)8.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Red

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorysecurity.paloaltonetworks.com/CVE-2026-0274