Prisma Access Agent CVE-2026-0246

Exploitation requires a locally authenticated, non-administrative OS user account on the target system - the CVSS 4.0 vector (PR:L) confirms low privileges are sufficient, and no interaction from another user is needed (UI:N). The target must be running Prisma Access Agent in a version below 26.2.1 on macOS, Linux, or Windows, with the agent service active (its normal operational state as an endpoint security client). The specific privilege management interface must be reachable by the local non-privileged user, which is expected by design since the agent serves all local users. Key limiting factors: the attacker must have an existing local session - physical presence, RDP, SSH, or equivalent remote shell - as there is no network-facing attack path (AV:L); at least a non-privileged OS account on that specific machine is required; and iOS, Android, and Chrome OS deployments are explicitly immune and cannot be exploited via this vulnerability.

The CVSS 4.0 base score of 5.9 reflects the local-only attack vector (AV:L), which is the primary risk-limiting factor - remote exploitation over a network is not possible. Attack complexity is low (AC:L) with no attack requirements (AT:N), meaning that once local access is obtained, the privilege escalation step itself is straightforward. EPSS is 0.01% at the 0th percentile, and SSVC confirms exploitation status as 'none' with the vulnerability rated non-automatable, both indicating no observed or anticipated widespread exploitation in the near term. The CVSSv4 exploit maturity of E:U (Unreported) aligns with the absence of any public proof-of-concept. Despite these low exploitation signals, SSVC rates technical impact as 'total,' meaning a successful attack yields full compromise of the vulnerable system's confidentiality, integrity, and availability. Real-world priority is moderate: organizations with shared endpoints, contractor workstations, or environments where non-admin local accounts are broadly provisioned face meaningful insider or post-compromise risk, but this is not a mass-exploitation or opportunistic internet-facing threat.

An attacker who has obtained a standard, non-administrative local account on a macOS, Linux, or Windows endpoint running Prisma Access Agent prior to 26.2.1 - whether through phishing, credential theft, or as an insider - calls the agent's privilege management interface without supplying or passing any authorization check, exploiting the CWE-862 flaw to have the privileged agent process elevate the attacker's session to root or NT AUTHORITY\SYSTEM. With full system privileges, the attacker harvests stored credentials, installs persistent malware, or uses the compromised endpoint as a pivot point for lateral movement within the enterprise network. No public proof-of-concept has been reported at time of analysis.