No special configuration is required to be affected by this vulnerability.
"}],"value":"No special configuration is required to be affected by this vulnerability."}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:palo_alto_networks:trust_protection_foundation:*:*:*:*:*:*:*:*","versionEndExcluding":"25.3.3","versionStartIncluding":"25.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:palo_alto_networks:trust_protection_foundation:*:*:*:*:*:*:*:*","versionEndExcluding":"25.1.8","versionStartIncluding":"25.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:palo_alto_networks:trust_protection_foundation:*:*:*:*:*:*:*:*","versionEndExcluding":"24.3.6","versionStartIncluding":"24.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:palo_alto_networks:trust_protection_foundation:*:*:*:*:*:*:*:*","versionEndExcluding":"24.1.13","versionStartIncluding":"24.1.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"other","value":"Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue."}],"datePublic":"2026-05-13T16:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform.
"}],"value":"A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform."}],"exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Palo Alto Networks is not aware of any malicious exploitation of this issue.
"}],"value":"Palo Alto Networks is not aware of any malicious exploitation of this issue."}],"impacts":[{"capecId":"CAPEC-66","descriptions":[{"lang":"en","value":"CAPEC-66 SQL Injection"}]}],"metrics":[{"cvssV4_0":{"Automatable":"YES","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":6.1,"baseSeverity":"MEDIUM","exploitMaturity":"UNREPORTED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:Y/R:U/V:C/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-05-13T19:04:52.841Z","orgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","shortName":"palo_alto"},"references":[{"tags":["vendor-advisory"],"url":"https://security.paloaltonetworks.com/CVE-2026-0242"}],"solutions":[{"lang":"eng","supportingMedia":[{"base64":false,"type":"text/html","value":"| Version | Minor Version | Suggested Solution |
|---|---|---|
| Trust Protection Foundation 25.3 | 25.3.0 through 25.3.2 | Upgrade to 25.3.3 or later. |
| Trust Protection Foundation 25.1 | 25.1.0 through 25.1.7 | Upgrade to 25.1.8 or later. |
| Trust Protection Foundation 24.3 | 24.3.0 through 24.3.5 | Upgrade to 24.3.6 or later. |
| Trust Protection Foundation 24.1 | 24.1.0 through 24.1.12 | Upgrade to 24.1.13 or later. |
| All older versions | Upgrade to a supported fixed version. |