Prisma Access Agent CVE-2026-0247

Exploitation requires the attacker to have an interactive local session on the targeted endpoint with at least low-privilege user-level access (PR:L per CVSS:4.0 vector), and the Prisma Access Agent with the Endpoint DLP component must be installed and running. The CVSS:4.0 attack vector is strictly local (AV:L), meaning remote unauthenticated exploitation is not possible - network-based or unauthenticated attack paths are excluded. No additional attack requirements are needed (AT:N), ruling out race conditions or environmental prerequisites. Exploitation is limited by: (1) mandatory local access to the endpoint, (2) low-privilege authenticated session required, (3) SSVC Automatable: no - mass or worm-like exploitation is not feasible, (4) Endpoint DLP component must be active on the host. These conditions meaningfully constrain the realistic attacker pool to insiders, physically present actors, or post-compromise lateral movers who have already established local access.

Despite a moderate CVSS 4.0 base score of 5.9, the SSVC technical impact is rated 'total', reflecting the triple-high impact scores (VC:H/VI:H/VA:H) on the vulnerable component - meaning a successful exploit fully compromises the DLP subsystem's confidentiality, integrity, and availability. However, several strong limiting signals reduce real-world priority: the attack vector is strictly local (AV:L), low privileges are required (PR:L), and SSVC marks the vulnerability as non-automatable. EPSS is 0.01% (1st percentile), indicating extremely low exploitation probability in the broader threat landscape. The vulnerability is not listed in the CISA KEV catalog, and the CVSS exploit maturity is 'Unreported' (E:U), meaning no public proof-of-concept or known exploitation activity has been observed. The combination of local-only vector, non-automatable exploitation, and absent KEV/POC signals this as a real but low-urgency issue requiring prioritization primarily for high-security or compliance-sensitive endpoint deployments where DLP integrity is critical. The gap between SSVC's 'total' technical impact and the moderate CVSS score is expected: CVSS:4.0 confines the high impact to the vulnerable component scope (SC:N/SI:N/SA:N), which caps the overall score.

A standard user account on a corporate endpoint running Prisma Access Agent (for example, a contractor or insider threat actor) locates an unauthenticated local interface - such as a named pipe, local socket, or IPC mechanism - exposed by the Endpoint DLP component, and sends a crafted request that bypasses authorization checks to execute a privileged operation such as disabling DLP policy enforcement, exfiltrating captured DLP telemetry, or corrupting the agent's integrity. No public exploit code has been identified at the time of analysis, and exploitation is classified as non-automatable by SSVC, suggesting manual tradecraft would be required.