Cortex Xdr Agent CVE-2026-0232

CVSS 4.0 with local attack vector (AV:L), high privileges required (PR:H), and integrity impact on agent availability (VA:H, Availability) reflects moderate baseline severity constrained by privilege requirements. However, real-world risk is elevated beyond the CVSS score due to: (1) detection evasion as primary impact-malware disabling EDR is a critical operational concern regardless of CVSS numeric rating; (2) insider threat and compromised admin scenarios where high privileges are present; (3) lateral movement post-compromise, where an attacker with admin access on one system can disable monitoring before executing lateral attack techniques. The CVSS vector shows AU:Y (authentication required) and R:U (no recovery), confirming this is a legitimate privilege-escalation and evasion vector rather than a low-risk informational issue. No active exploitation or public POC has been identified, keeping real-world risk lower than potential. Organizations with strong privilege management and admin account hardening can mitigate; organizations with weak PAM or frequent admin use of standard accounts face higher practical risk.

A malware infection gains code execution in the context of a local Windows administrator account (through phishing, watering hole, or supply chain compromise). The malware leverages the CVE-2026-0232 protection mechanism bypass to disable the Cortex XDR Agent, removing real-time monitoring and preventing detection of subsequent lateral movement, credential theft, or data exfiltration. The attacker then operates freely within the network without triggering EDR alerts.