CVE-2026-0274 is an improper credential validation flaw (CVSS 9.1 in the record) in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM. An unauthenticated attacker could reach and change protected resources. Palo Alto Networks says to upgrade the pack to version 1.2.0 or later.
What's affected
From the vendor advisory: the CommvaultSecurityIQ marketplace pack for Cortex XSOAR and Cortex XSIAM, versions 1.1.0 through 1.1.9. Version 1.2.0 and later is unaffected. No special configuration is needed to be affected.
The vendor scores it 8.1 with its threat adjusted method, and 9.3 on the base score of CVSS 4.0.
How to check if you're exposed
In the marketplace, open installed content packs and read the CommvaultSecurityIQ version. Versions 1.1.0 through 1.1.9 are affected. If you do not use the integration, uninstall the pack.
What to do now
- Upgrade the CommvaultSecurityIQ pack to 1.2.0 or later.
- Uninstall the pack if you do not use it.
- The vendor lists no workaround.
- Review integration logs for unexpected inbound calls.
- Check that the integration account has only the access it needs.
The lesson here is about integrations. Every connector in an automation platform is another door, and each needs its own credential check. When you upgrade, take the chance to list all installed marketplace packs and remove those that nobody uses.
For the ones you keep, review the account or key the integration uses. Give it only the rights it needs. If the integration touches a backup product, as this one does, compromise could affect recovery options, so give that connection extra attention.
Set a calendar reminder to check the marketplace for pack updates each month, since pack versions move separately from platform versions.
Why it matters
The weakness is CWE-1390 (weak authentication). The integration did not properly validate the credentials presented to it, so a caller without valid credentials could be treated as legitimate. Integrations in orchestration platforms often hold broad rights, so a weak entry point has a large reach.
The vendor says internal research teams found it and that it is not aware of exploitation. The record does not mark it as KEV.
Quick check
Do I need special settings to be affected?
No. The advisory says no special configuration is required.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
