Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-0233, CVE-2026-0234 |
| Alert Source | Palo Alto Networks Security Advisory |
| CVE Publication Year | 2026 |
| Date Published | 2026-04-09 |
| Vendor | Palo Alto Networks |
| Products | Cortex XSOAR, Cortex XSIAM, ADEM |
| Vulnerability Type | Arbitrary Code Execution / Security Feature Bypass |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Two high severity vulnerabilities have been identified in Palo Alto Networks products:
CVE-2026-0233 — Arbitrary Code Execution
This vulnerability allows an unauthenticated attacker to execute arbitrary code on affected systems. It affects the Microsoft Teams Marketplace component in Cortex XSOAR and XSIAM.
CVE-2026-0234 — Security Feature Bypass
This vulnerability allows bypassing security mechanisms, which combined with CVE-2026-0233 could lead to full compromise of security orchestration and management platforms.
Cortex XSOAR and XSIAM products are critical components of SOAR/SIEM infrastructure in many organizations — their compromise could enable an attacker to access the entire security ecosystem.
Affected Products
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Autonomous Digital Experience Manager (ADEM) | 5.10.x prior to 5.10.14 | 5.10.14 |
| Cortex XSIAM Microsoft Teams Marketplace | 1.5.x prior to 1.5.52 | 1.5.52 |
| Cortex XSOAR Microsoft Teams Marketplace | 1.5.x prior to 1.5.52 | 1.5.52 |
Required Actions
- Verify installed Palo Alto Networks product versions
- Update affected products to the latest versions:
- ADEM → update to 5.10.14 or later
- Cortex XSIAM/XSOAR Microsoft Teams Marketplace → update to 1.5.52 or later
- Monitor system logs for suspicious activity
References
- Palo Alto Networks Security Advisory CVE-2026-0233
- Palo Alto Networks Security Advisory CVE-2026-0234
How can nFlo help?
If your organization uses products affected by this vulnerability, contact us. We can help with:
- Verifying whether your systems are at risk
- Implementing patches and risk mitigation
- Monitoring for exploitation attempts in your environment
Useful resources:
