{"id":"CVE-2026-0238","title":"A vulnerability in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into certain Broker VM fields.","summary":"A vulnerability in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into certain Broker VM fields.","severity":"low","cvss":3.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N","cwe":["CWE-20"],"vendor":"paloaltonetworks","product":"broker_vm","affected":["broker_vm >= 30.0.0, < 30.0.24"],"patched":["broker_vm 30.0.24"],"published":"2026-05-13","updated":"2026-07-13","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0238","references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0238","label":"psirt@paloaltonetworks.com"}],"tags":["nvd"],"epss":0.00098,"epssPercentile":0.00882,"ingestedAt":"2026-07-13T14:27:26.678Z","slug":"CVE-2026-0238","body":"## Overview\n\nA vulnerability in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into certain Broker VM fields.\n\n## Affected\n\n- `broker_vm >= 30.0.0, < 30.0.24`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `broker_vm 30.0.24`","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":17.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}