CVE-2025-2184: Cortex XDR Broker VM: Secrets Shared Across Multiple Broker VM Images (Severity: MEDIUM)
A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal services. Users knowing these default credentials could access internal services on other Broker VM installations.
The attacker must have network access to the Broker VM to exploit this issue.
Affected Software
Remediation
Mitigation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2184?
CVE-2025-2184 is a high-severity vulnerability due to its potential for unauthorized access to internal services.
How do I fix CVE-2025-2184?
To fix CVE-2025-2184, ensure that you update your Palo Alto Networks Cortex XDR Broker VM to a version that addresses this flaw.
What impact does CVE-2025-2184 have on affected systems?
CVE-2025-2184 allows attackers with knowledge of default credentials to access internal services on affected Broker VM installations.
Which versions of the Cortex XDR Broker VM are affected by CVE-2025-2184?
Versions of the Palo Alto Networks Cortex XDR Broker VM up to and including 28.0.52 and version 28.0.0 are affected by CVE-2025-2184.
Are there any mitigations for CVE-2025-2184 for users unable to upgrade?
Users unable to upgrade should immediately change the default credentials to unique, strong passwords to mitigate the risk associated with CVE-2025-2184.