Loading story…
The Open Source Technology Improvement Fund (OSTIF) published the results of a security audit of Cortex, the open source long-term, multi-tenant scalable storage system used with Prometheus and OpenTelemetry. The whitebox assessment was carried out by two Quarkslab auditors in early spring 2026 and covered discovery, threat-model review, static code analysis, and dynamic testing, with particular focus on tenant-boundary security and cluster operations.
The audit identified seven findings with security impact, alongside documentation issues and recommendations for future security work. OSTIF said all seven security findings have received verified fixes, and it urged users to update to the latest Cortex release to obtain the remediations. Quarkslab separately published technical details on the audit in its own write-up.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
OSTIF reported that all seven audit findings had received verified fixes and advised users to update to the most recent Cortex release.
The audit found seven issues with security impact in Cortex, along with documentation and recommendations for future security development.
In early spring 2026, two Quarkslab auditors performed a whitebox security assessment of Cortex covering discovery, threat-model review, static code analysis, and dynamic testing, with emphasis on tenant boundary security and cluster operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed **CVE-2026-0234**, a high-severity flaw in the Microsoft Teams Marketplace integration for **Cortex XSOAR** and **Cortex XSIAM**. The vulnerability stems from improper verification of a cryptographic signature, allowing a remote, unauthenticated attacker to forge signatures and access sensitive resources without user interaction. Palo Alto rated the issue **CVSS 9.2**, and reporting said successful exploitation could let attackers view or modify protected data, alter security playbooks, and disrupt incident response operations. The affected software includes Microsoft Teams Marketplace integration versions **1.5.0 through 1.5.51** for both products. Palo Alto said the issue was discovered by an external researcher identified as **"quinn"** and reported that there is **no known in-the-wild exploitation**. The company also said **no workaround is available**, making an upgrade to **version 1.5.52 or later** the required remediation for exposed deployments.
Jun 29, 2026
**Palo Alto Networks** published security advisories addressing multiple vulnerabilities affecting *Cortex XDR* components and *Prisma Browser*, including **CVE-2026-0230** (macOS Cortex XDR Agent can be disabled by a local administrator) and **CVE-2026-0231** (Cortex XDR Broker VM information disclosure). For CVE-2026-0230, Palo Alto Networks reported a protection-mechanism issue on macOS that could allow malware to operate without detection if a local admin disables the agent; affected versions include *Cortex XDR Agent* **8.7-CE** prior to `8.7.101-CE` and **8.3-CE** prior to `8.3.102-CE` on macOS, with Palo Alto Networks stating it is not aware of in-the-wild exploitation. For CVE-2026-0231, an authenticated user with network access to the Broker VM could obtain and modify sensitive information by triggering a live terminal session via the Cortex UI and changing configuration settings; the issue affects *Cortex XDR Broker VM* **30.0.0** prior to `30.0.49`, and Palo Alto Networks stated there are no workarounds and that upgrading is required. Palo Alto Networks also released **PAN-SA-2026-0003**, incorporating upstream **Chromium** security fixes into *Prisma Browser* and listing multiple Chromium CVEs (including **CVE-2026-2314**, **CVE-2026-2321**, and **CVE-2026-2441**); *Prisma Browser* versions prior to `145.7.9.76` are affected and should be updated. The **Canadian Centre for Cyber Security** echoed these Palo Alto Networks advisories and urged organizations to apply the necessary updates and mitigations. A separate Canadian advisory covered **Splunk** product vulnerabilities across *Splunk Enterprise*, *Splunk Cloud Platform*, and multiple *AppDynamics* agents, but it is unrelated to the Palo Alto Networks Cortex/Prisma issues.
Jun 29, 2026
Multiple vendors issued fixes for **high-impact vulnerabilities** that could enable privilege escalation, tenant-wide compromise, security feature bypass, or remote code execution. OpenStack patched **CVE-2026-22797** in *keystonemiddleware* affecting deployments using `external_oauth2_token`, where failure to sanitize incoming identity headers allows authenticated users to forge headers (e.g., `X-Is-Admin-Project`, `X-Roles`, `X-User-Id`) to **escalate privileges or impersonate other users**; fixes were released across supported branches and the issue was reported by a Red Hat researcher. Microsoft patched **CVE-2026-20965** in *Windows Admin Center*’s Azure SSO (fixed in Azure Extension **v0.70.00**), where improper token validation could let an attacker with local admin on a WAC-enabled Azure VM/Arc machine combine a stolen `WAC.CheckAccess` token with a forged PoP token to enable **lateral movement and tenant-wide access** under certain conditions. Separately, Microsoft addressed **CVE-2026-20824** in *Windows Remote Assistance*, an **Important** security feature bypass that can allow attackers to evade **Mark of the Web (MOTW)** protections via social engineering. Progress Software also released patches for **CVE-2025-13444** and **CVE-2025-13447** (CVSS 8.4) affecting *LoadMaster* and *MOVEit WAF*, where crafted UI/API requests can trigger **command injection leading to remote code execution**; the vendor stated it had no evidence of in-the-wild exploitation at the time of release.
Jun 29, 2026