Prisma Access Agent CVE-2026-0245

Exploitation requires local, authenticated access to a Windows or macOS system running Prisma Access Agent versions prior to 26.2.1. The CVSS vector (PR:L) confirms a low-privilege local account is sufficient - no administrative rights are needed. No network access, no user interaction, and no non-default configuration are required on affected platforms (AC:L/AT:N/UI:N). Exploitation is NOT possible remotely. Platforms explicitly excluded from this vulnerability include Linux, ChromeOS, Android, and iOS - deployments on those platforms are not at risk. The primary limiting factor is the requirement for physical or logical local access to the affected endpoint; this restricts the attacker pool to insiders, physically present actors, or those who have already achieved initial compromise on the target machine.

The composite risk picture is low-to-moderate. CVSS 4.0 scores this at 4.3, reflecting local attack vector (AV:L) which already limits exposure to authenticated, on-device actors - not remote attackers. The VC:H element is the most concerning signal: a successful local read yields high confidentiality impact, meaning full credential or configuration disclosure is plausible, not just a minor data leak. EPSS sits at 0.01% (0th percentile), indicating virtually no observed exploitation activity across the internet-scale telemetry corpus. SSVC corroborates this: exploitation is 'none', automatable is 'no', and technical impact is 'partial'. KEV status is absent, meaning CISA has not confirmed active exploitation. The E:U (Exploit Unlikely) modifier in the CVSS 4.0 supplemental vector and the Amber urgency rating together suggest Palo Alto views this as a real but non-emergency issue. In practice, the threat actor profile is an insider or a post-compromise attacker who already has local access - not an external adversary. The credential exposure risk is the highest real-world concern, as stolen VPN/SASE credentials can enable lateral movement.

An attacker who has already compromised a Windows or macOS endpoint - or a malicious insider - with a low-privilege local user account reads Prisma Access Agent configuration files or credential storage locations to extract VPN credentials or tunnel configuration data. These credentials could then be used from a separate device to authenticate directly to the Prisma Access infrastructure, bypassing endpoint security controls. No public exploit code has been identified at time of analysis, so this scenario currently requires knowledge of the specific file paths or registry locations involved.