CVE-2026-0274: Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integration

Synopsis

An improper credential validation vulnerability affects the CommvaultSecurityIQ integration for Palo Alto Networks Cortex XSOAR and Cortex XSIAM. The flaw is reachable over the network and requires no authentication, meaning any remote attacker who can reach the service can exploit it without needing an account or credentials. Successful exploitation gives the attacker full read and write access to protected resources within the integration. A patched-image rebuild at version 1.2.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the CommvaultSecurityIQ integration endpoint over the network; any host with network access to the service is in scope.

• AuthenticationNot required

  No account or credential of any privilege level is needed; the vulnerability is exploitable by a completely unauthenticated caller.

• Victim interactionNot required

  No user action or social engineering is required; the attacker interacts directly with the service endpoint.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environment-specific setup.

Blast Radius

• The attacker reads protected resources within the CommvaultSecurityIQ integration, including backup job data, alert records, and any credentials or tokens stored by the integration.
• The attacker modifies protected resources, allowing them to alter security alerts, tamper with backup job configurations, or inject false event data into XSOAR/XSIAM playbooks.
• Because the integration bridges Commvault telemetry into a SOAR platform, tampered data can corrupt automated incident-response decisions downstream of the integration.