Loading story…
Palo Alto Networks disclosed CVE-2026-0234, a high-severity flaw in the Microsoft Teams Marketplace integration for Cortex XSOAR and Cortex XSIAM. The vulnerability stems from improper verification of a cryptographic signature, allowing a remote, unauthenticated attacker to forge signatures and access sensitive resources without user interaction. Palo Alto rated the issue CVSS 9.2, and reporting said successful exploitation could let attackers view or modify protected data, alter security playbooks, and disrupt incident response operations.
The affected software includes Microsoft Teams Marketplace integration versions 1.5.0 through 1.5.51 for both products. Palo Alto said the issue was discovered by an external researcher identified as "quinn" and reported that there is no known in-the-wild exploitation. The company also said no workaround is available, making an upgrade to version 1.5.52 or later the required remediation for exposed deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks disclosed CVE-2026-0234 and released a fix by requiring customers to upgrade the Microsoft Teams integration to version 1.5.52 or later. The company rated the flaw high severity, said no workaround exists, and stated it had no evidence of in-the-wild exploitation at disclosure.
An external researcher identified an improper verification of cryptographic signature vulnerability in the Microsoft Teams Marketplace integration for Cortex XSOAR and Cortex XSIAM. The issue affects versions 1.5.0 through 1.5.51 and could allow remote, unauthenticated attackers to forge signatures and access sensitive resources.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurity.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2026-42835**, an Important-severity information disclosure vulnerability in **Microsoft Teams for Android** that could allow a remote, authenticated low-privileged attacker to access small portions of heap memory without user interaction. The flaw, classified as **CWE-74** for improper neutralization of special elements in output used by a downstream component, carries a **CVSS 3.1 score of 8.1** and may expose sensitive runtime data including authentication tokens, session information, or cached credentials. Microsoft said the vulnerability was responsibly reported by **Ofek Levin of Enclave** through its coordinated disclosure program and has released a security update through the **Google Play Store**. The company stated that exploitation is considered less likely and that it had seen no public disclosure or evidence of active exploitation at the time of publication, but organizations using Teams for sensitive internal communications were urged to update affected Android clients promptly.
Jun 29, 2026
Cisco disclosed a critical certificate validation vulnerability in cloud-based **Webex Services** that could let an unauthenticated remote attacker bypass authentication and impersonate legitimate users in environments using single sign-on through **Webex Control Hub**. The flaw, tracked as `CVE-2026-20184` and rated **CVSS 9.8**, stems from improper certificate validation in the SSO implementation (`CWE-295`), which could cause malicious authentication tokens to be accepted as valid. Cisco said it patched the backend cloud service, but affected organizations must also manually upload a new **SAML certificate** for their Identity Provider in Webex Control Hub to fully remediate the issue. The company said there are **no workarounds**, warned that customers who do not update their SAML certificates may remain exposed and could face service disruption, and added that the vulnerability was found during internal security testing with **no known public exploitation** reported at disclosure.
Jun 29, 2026
**Palo Alto Networks** published security advisories addressing multiple vulnerabilities affecting *Cortex XDR* components and *Prisma Browser*, including **CVE-2026-0230** (macOS Cortex XDR Agent can be disabled by a local administrator) and **CVE-2026-0231** (Cortex XDR Broker VM information disclosure). For CVE-2026-0230, Palo Alto Networks reported a protection-mechanism issue on macOS that could allow malware to operate without detection if a local admin disables the agent; affected versions include *Cortex XDR Agent* **8.7-CE** prior to `8.7.101-CE` and **8.3-CE** prior to `8.3.102-CE` on macOS, with Palo Alto Networks stating it is not aware of in-the-wild exploitation. For CVE-2026-0231, an authenticated user with network access to the Broker VM could obtain and modify sensitive information by triggering a live terminal session via the Cortex UI and changing configuration settings; the issue affects *Cortex XDR Broker VM* **30.0.0** prior to `30.0.49`, and Palo Alto Networks stated there are no workarounds and that upgrading is required. Palo Alto Networks also released **PAN-SA-2026-0003**, incorporating upstream **Chromium** security fixes into *Prisma Browser* and listing multiple Chromium CVEs (including **CVE-2026-2314**, **CVE-2026-2321**, and **CVE-2026-2441**); *Prisma Browser* versions prior to `145.7.9.76` are affected and should be updated. The **Canadian Centre for Cyber Security** echoed these Palo Alto Networks advisories and urged organizations to apply the necessary updates and mitigations. A separate Canadian advisory covered **Splunk** product vulnerabilities across *Splunk Enterprise*, *Splunk Cloud Platform*, and multiple *AppDynamics* agents, but it is unrelated to the Palo Alto Networks Cortex/Prisma issues.
Jun 29, 2026