CVE-2026-0242

{
  "id": "CVE-2026-0242",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-13T19:16:58.130",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Undergoing Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL en Trust Protection Foundation permite a un atacante autenticado ejecutar comandos SQL arbitrarios contra la base de datos del producto. La explotación exitosa podría permitir a un atacante leer datos sensibles, modificar el contenido de la base de datos y escalar privilegios para obtener control administrativo total de la plataforma."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Palo Alto Networks",
          "product": "Trust Protection Foundation",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "25.3.0",
              "lessThan": "25.3.3",
              "versionType": "custom",
              "status": "affected",
              "changes": [
                {
                  "at": "25.3.3",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "25.1.0",
              "lessThan": "25.1.8",
              "versionType": "custom",
              "status": "affected",
              "changes": [
                {
                  "at": "25.1.8",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "24.3.0",
              "lessThan": "24.3.6",
              "versionType": "custom",
              "status": "affected",
              "changes": [
                {
                  "at": "24.3.6",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "24.1.0",
              "lessThan": "24.1.13",
              "versionType": "custom",
              "status": "affected",
              "changes": [
                {
                  "at": "24.1.13",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "UNREPORTED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "YES",
          "Recovery": "USER",
          "valueDensity": "CONCENTRATED",
          "vulnerabilityResponseEffort": "MODERATE",
          "providerUrgency": "AMBER"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T00:00:00+00:00",
          "id": "CVE-2026-0242",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://security.paloaltonetworks.com/CVE-2026-0242",
      "source": "[email protected]"
    }
  ]
}