ETK-2026-85Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-85",
  "cve_id": null,
  "display_id": "ETK-2026-85",
  "ghsa_id": "GHSA-w754-prh8-m56j",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "XML injection in aisoc-actions PAN-OS API commands",
  "summary": "aisoc-actions before 12.1.0 can construct PAN-OS User-ID API XML from inadequately validated IP and tag parameters. An authenticated user permitted to execute actions may alter firewall dynamic address group membership or cause intended containment actions to have unintended results.",
  "mitigation": "Upgrade aisoc-actions to version 12.1.0 or later. Until upgraded, restrict action-execution permissions to trusted users and validate IP and tag inputs before they reach the integration.",
  "vendor": "pip",
  "product": "pip:aisoc-actions",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.1.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "12.1.0"
      ],
      "package_name": "aisoc-actions",
      "purl": "pkg:pypi/aisoc-actions"
    }
  ],
  "cwes": [
    91
  ],
  "cvss_score": 8.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.1334306,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-09-29T03:04:30+00:00",
      "days": -22.146885136631944,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T06:36:01.023787+00:00",
      "url": "https://github.com/beenuar/AiSOC/security/advisories/GHSA-w754-prh8-m56j"
    }
  }
}