CVE-2026-0240
Full vulnerability record from the local CVENow database.
Description
An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.
Severity
MEDIUM
CVSS score
4.5
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-13 19:16:57.767000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-0240",
"sourceIdentifier": "[email protected]",
"published": "2026-05-13T19:16:57.767",
"lastModified": "2026-10-26T14:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings."
},
{
"lang": "es",
"value": "Una vulnerabilidad de revelación de información en Trust Protection Foundation permite a un atacante autenticado obtener información sensible del almacén del servidor. La explotación exitosa de este problema permite al atacante suplantar a cualquier usuario dentro del entorno y modificar arbitrariamente la configuración."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Palo Alto Networks",
"product": "Trust Protection Foundation",
"defaultStatus": "unaffected",
"versions": [
{
"version": "25.3.0",
"lessThan": "25.3.3",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "25.3.3",
"status": "unaffected"
}
]
},
{
"version": "25.1.0",
"lessThan": "25.1.8",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "25.1.8",
"status": "unaffected"
}
]
},
{
"version": "24.3.0",
"lessThan": "24.3.6",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "24.3.6",
"status": "unaffected"
}
]
},
{
"version": "24.1.0",
"lessThan": "24.1.13",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "24.1.13",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NO",
"Recovery": "USER",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "AMBER"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.3,
"impactScore": 5.8
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-15T03:56:11.417596Z",
"id": "CVE-2026-0240",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-497"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:trust_protection_foundation:*:*:*:*:*:*:*:*",
"versionStartIncluding": "24.1.0",
"versionEndExcluding": "24.1.13",
"matchCriteriaId": "52DC45A9-9B20-4C9C-B080-95454CBF843B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:trust_protection_foundation:*:*:*:*:*:*:*:*",
"versionStartIncluding": "24.3.0",
"versionEndExcluding": "24.3.6",
"matchCriteriaId": "7EEE94C3-ADA5-4F01-A670-F902B48FEF65"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:trust_protection_foundation:*:*:*:*:*:*:*:*",
"versionStartIncluding": "25.1.0",
"versionEndExcluding": "25.1.8",
"matchCriteriaId": "134B1209-C811-42B3-9F9A-D73A039B5E7C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:trust_protection_foundation:*:*:*:*:*:*:*:*",
"versionStartIncluding": "25.3.0",
"versionEndExcluding": "25.3.3",
"matchCriteriaId": "AD9D632C-8323-4099-8C50-6023335414D1"
}
]
}
]
}
],
"references": [
{
"url": "https://security.paloaltonetworks.com/CVE-2026-0240",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}