Palo Alto Networks week 40: medium-severity credential flaw in Itron MV-90 xi

The release at a glance

Palo Alto Networks' week 40 release, covering 28 September to 4 October 2026, contains a single CVE. The affected product is Itron MV-90 xi, and the issue is rated medium severity. CVE-2026-103548 was published on 30 September 2026 and describes improperly stored credentials in the product's configuration file. No CVE in this release is marked as exploited, and none is listed in CISA's Known Exploited Vulnerabilities catalogue. The advisory does not list a fixed version or a vendor fix, and the fix availability field is false; it also does not state whether a workaround exists. The vendor has not assigned an additional rating. The release totals one CVE, all medium severity, and names no other products.

What matters most

Only CVE-2026-103548 requires attention this week. It affects Itron MV-90 xi version 3.0, the only affected version named in the release. The CVSS 4.0 base score is 5.3, which corresponds to medium severity. The vector is CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/E:P. In practice, the application stores passwords and password histories in its configuration file in a form that a local attacker with low privileges can decode. An attacker who can read that file could use the recovered credentials to access the MV-90 application as any user. The CVE record lists CWE-257, CWE-260 and CWE-261. The vulnerability is not in CISA KEV and is not marked as exploited. The exploitation record also marks public disclosure as false. The SSVC fields show no exploitation, not automatable, and partial technical impact. EPSS is 0.1%, in the 1st percentile. The advisory does not state whether a workaround exists.

Patch in this order

1. Identify any Itron MV-90 xi 3.0 installations and determine which local accounts can read the application configuration file. Because the flaw assumes low privileges, any local user with file-read access should be treated as a potential route to decoded credentials.
2. Restrict access to the configuration file and the host before anything else. Remove unneeded local accounts, limit read permissions, and audit reads of the file. The local attack vector means network perimeter controls do not address the root risk; focus on host-level access.
3. Treat the stored password history as exposed material. After restricting access, consider rotating application passwords and clearing or protecting password history so previously recorded values cannot be replayed.
4. Monitor Palo Alto Networks' advisory for a fixed version. None is listed in this release, and fix availability is false, so do not schedule a patch until a fixed version is announced.
5. If file access cannot be restricted quickly, isolate the host or reduce the sensitivity of the data and systems it can reach. There is no CISA KEV due date because this CVE is not in the catalogue.

Beyond the patch

A week with one medium-severity local flaw and no fix is easier to manage when you already know which suppliers' software is in your estate and how each supplier's patch cycle behaves. Supply Chain Defense & Third-Party Risk helps maintain that inventory and track the exposure window this advisory creates, so a single finding does not become an unexpected gap.