CVE-2026-0241
Full vulnerability record from the local CVENow database.
Description
Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.
Severity
MEDIUM
CVSS score
5.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-13 19:16:57.973000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-0241",
"sourceIdentifier": "[email protected]",
"published": "2026-05-13T19:16:57.973",
"lastModified": "2026-10-26T14:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources."
},
{
"lang": "es",
"value": "Vulnerabilidades de autorización incorrecta en Trust Protection Foundation permiten a los atacantes eludir los controles de acceso y realizar acciones no autorizadas en recursos restringidos."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Palo Alto Networks",
"product": "Trust Protection Foundation",
"defaultStatus": "unaffected",
"versions": [
{
"version": "25.3.0",
"lessThan": "25.3.3",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "25.3.3",
"status": "unaffected"
}
]
},
{
"version": "25.1.0",
"lessThan": "25.1.8",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "25.1.8",
"status": "unaffected"
}
]
},
{
"version": "24.3.0",
"lessThan": "24.3.6",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "24.3.6",
"status": "unaffected"
}
]
},
{
"version": "24.1.0",
"lessThan": "24.1.13",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "24.1.13",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NO",
"Recovery": "USER",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "AMBER"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-13T19:16:03.842883Z",
"id": "CVE-2026-0241",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-754"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:trust_protection_foundation:*:*:*:*:*:*:*:*",
"versionStartIncluding": "24.1.0",
"versionEndExcluding": "24.1.13",
"matchCriteriaId": "52DC45A9-9B20-4C9C-B080-95454CBF843B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:trust_protection_foundation:*:*:*:*:*:*:*:*",
"versionStartIncluding": "24.3.0",
"versionEndExcluding": "24.3.6",
"matchCriteriaId": "7EEE94C3-ADA5-4F01-A670-F902B48FEF65"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:trust_protection_foundation:*:*:*:*:*:*:*:*",
"versionStartIncluding": "25.1.0",
"versionEndExcluding": "25.1.8",
"matchCriteriaId": "134B1209-C811-42B3-9F9A-D73A039B5E7C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:trust_protection_foundation:*:*:*:*:*:*:*:*",
"versionStartIncluding": "25.3.0",
"versionEndExcluding": "25.3.3",
"matchCriteriaId": "AD9D632C-8323-4099-8C50-6023335414D1"
}
]
}
]
}
],
"references": [
{
"url": "https://security.paloaltonetworks.com/CVE-2026-0241",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}