Hackers Can Abuse Cortex XDR Live Terminal Feature for C2 Communications

Overview of Cortex XDR Live Terminal Vulnerability

A recent study has identified a potential misuse of the Cortex XDR Live Terminal feature by Palo Alto Networks, which attackers can exploit as a command-and-control (C2) channel. This feature, integrated within a trusted endpoint detection and response (EDR) agent, generates traffic that is commonly accepted by enterprise security tools, making it difficult to detect when abused.

Cortex XDR’s Live Terminal enables security teams to execute commands, run scripts, browse files, and manage processes on endpoints from a central console. It operates through WebSocket connections to Palo Alto’s cloud infrastructure. However, researchers discovered that the underlying protocol lacks command signing, allowing attackers to intercept and redirect the endpoint’s connection to a server they control.

Researchers at InfoGuard Labs revealed that the client-side component of Live Terminal, cortex-xdr-payload.exe , is trusted by the EDR engine, enabling commands to bypass detection and prevention rules. Two methods of abuse were identified:

Cross-Tenant Attack: Attackers use their own Cortex tenant to generate a valid session token, redirecting the victim’s endpoint to connect to the attacker-controlled tenant. Custom Server Creation: Attackers replicate the WebSocket communication protocol to redirect the connection with minimal development effort.

Organizations using Cortex XDR are at risk, as attackers can achieve persistent and concealed control over compromised endpoints without deploying additional tools. The technique generates network traffic that blends with normal Cortex agent traffic, often bypassing TLS inspection.

Upon initiating a Live Terminal session, a WebSocket message from Palo Alto’s cloud instructs the agent to launch cortex-xdr-payload.exe with specific server and token values. A flaw in the server address validation allows crafted URLs to connect to attacker-controlled servers.

Palo Alto Networks was informed of these findings on September 30, 2025, and issued updates in versions 8.7 through 8.9. However, testing on February 23, 2026, revealed that the vulnerability persists in version 8.9.1.

Security teams should monitor process creation events and flag any instance where cortex-xdr-payload.exe is launched by a non-standard parent process. Palo Alto Networks is advised to implement mutual authentication and cryptographic command signing in the Live Terminal protocol. A redesign that ensures secure architecture is necessary to prevent protocol-level abuse.

Based on reporting by Cyber Security News.