CVE-2026-0274: Cortex XSOAR and XSIAM: Improper Credential Validation in CommvaultSecurityIQ Integration
CVE-2026-0274 is an improper validation of credentials flaw in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM, as described by Palo Alto Networks. The record describes unauthenticated access to and modification of protected resources, and NVD lists it as critical with a score of 9.1. The sources consulted show no confirmed exploitation, and the record provides no fixed version.
Overview
CVE-2026-0274 affects the CommvaultSecurityIQ integration pack used in Cortex XSOAR and Cortex XSIAM. The issue is classified as improper validation of credentials (the record lists CWE-1390 without a name). The vendor advisory is still under analysis according to the record's source status.
Impact
The record states that an unauthenticated attacker may access and modify protected resources. The NVD vector indicates network reachability, low complexity, no privileges required, no user interaction, high confidentiality and integrity impact, and no availability impact. The NVD score is 9.1 (critical). The CNA lists a separate score of 8.1.
Affected products and versions
The record lists two products: the CommvaultSecurityIQ marketplace content for Cortex XSIAM and for Cortex XSOAR. Both list version 1.1.0 and the range from 1.1.0 up to but not including 1.2.0 as affected.
- Cortex XSIAM CommvaultSecurityIQ marketplace content: version 1.1.0 and the range from 1.1.0 before 1.2.0.
- Cortex XSOAR CommvaultSecurityIQ marketplace content: version 1.1.0 and the range from 1.1.0 before 1.2.0.
The record contains no fixed version. Versions from 1.2.0 onward fall outside the listed range, but the record does not confirm that they are fixed.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The SSVC fields in the record show exploitation as none and automatable as yes.
Remediation and mitigation
Review the vendor advisory at Palo Alto Networks advisory for the current guidance and any update that addresses the issue. Organizations running the affected integration should inventory deployed marketplace content and confirm whether it falls within the listed range. Limit access to the automation platform to trusted administrators and review the credentials the integration uses.
Detection guidance
- Review authentication and access logs for the integration account and for unexpected reads or changes to protected resources.
- Watch for changes to integration configuration or to credentials used by the CommvaultSecurityIQ content.
- Correlate platform activity with network access from unexpected sources.
Limitations of the available information
The record does not provide a fixed version, a patch identifier, or a detailed technical description beyond the summary. The CWE name is missing. The NVD status is still undergoing analysis, so scores and classifications may change. The EPSS values in the record are low, but they do not confirm or rule out exploitation.
Frequently asked questions
What is CVE-2026-0274?
It is an improper validation of credentials flaw in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM, according to the record.
Which versions are affected?
The record lists version 1.1.0 and the range from 1.1.0 before 1.2.0 for both the XSIAM and XSOAR marketplace content.
Is this CVE known to be exploited?
The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.