CVE-2026-0234: Palo Alto Cortex XSOAR and XSIAM: signature verification flaw in Microsoft Teams integration
CVE-2026-0234 is a critical-rated flaw in the Microsoft Teams integration of Palo Alto Networks Cortex XSOAR and Cortex XSIAM, where a cryptographic signature is not properly verified (CWE-347). The record states that an unauthenticated user could access and modify protected resources. The affected range is listed as 1.5.0 up to, but not including, 1.5.52, and no fixed version is listed in the sources consulted.
Overview
CVE-2026-0234 is a critical-rated weakness (CWE-347, improper verification of cryptographic signature) in the Microsoft Teams integration of Palo Alto Networks Cortex XSOAR and Cortex XSIAM. The record describes it as allowing an unauthenticated user to access and modify protected resources. The record was published on 2026-04-13 and its source status is Undergoing Analysis.
Impact
- The NVD base score in the record is 9.1 (critical).
- The NVD vector in the record rates confidentiality and integrity impact as high and availability impact as none.
- A separate score of 7.2 under the newer CVSS framework is provided by the vendor PSIRT and by the CNA.
- The SSVC technical impact is recorded as total.
Affected products and versions
- Cortex XSOAR and Cortex XSIAM, together with their Microsoft Teams Marketplace integrations, are listed as affected from 1.5.0 up to, but not including, 1.5.52.
- The record lists no fixed version. Whether 1.5.52 is a fixed release cannot be confirmed from the sources consulted.
Exploitation status
The CVE is not listed in the CISA KEV catalog according to the record. No confirmed active exploitation appears in the sources consulted. The SSVC exploitation value is recorded as none and automatable as no. The EPSS probability is recorded as 0.00231 with a percentile of 0.13212.
Remediation and mitigation
- Inventory Cortex XSOAR and Cortex XSIAM deployments and record the version of the Microsoft Teams integration in use.
- Give priority to deployments that fall within the listed affected range and follow the upgrade guidance in the Palo Alto Networks security advisory.
- Until an update is applied, restrict who can reach the Teams integration and its related resources, and limit network exposure of the platform where practical.
- Confirm the fixed version with the vendor before closing the item, because the record does not state one.
Detection guidance
- Review audit and integration logs for unexpected changes to protected resources or configuration connected to the Teams integration.
- Look for Teams integration activity that cannot be tied to an expected, authenticated user or service identity.
- Retain logs covering the period since the affected version was deployed, as far as retention settings allow.
Limitations of the available information
- The record does not include a fixed version, a patch identifier or technical details of the signature check.
- The NVD score and the vendor and CNA score use different CVSS versions and should not be compared directly.
- The EPSS date in the record (2026-10-23) is later than the publication date, so the EPSS values should be treated as recorded and checked again.
- The source status is Undergoing Analysis, so the details may change.
Frequently asked questions
Is CVE-2026-0234 being actively exploited?
The record shows the CVE is not in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. Teams should still prioritize review because the NVD score is critical.
Which versions are affected?
The record lists Cortex XSOAR and Cortex XSIAM, including their Microsoft Teams Marketplace integrations, as affected from 1.5.0 up to, but not including, 1.5.52.
Is there a fixed version?
The record does not list a fixed version. Confirm the fixed release with the vendor advisory at security.paloaltonetworks.com before closing the item.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.