Prisma Access Agent CVE-2026-0268

The primary remediation is to apply the vendor-released patch per the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0268. A patch is available per the vendor advisory; however, the exact fixed version of Prisma Access Agent for Linux was not independently confirmed from the provided intelligence, and administrators must consult the advisory directly for the specific target version. As a compensating control pending patching, organizations can enforce mandatory network-layer egress restrictions via perimeter or host-based firewall rules that block direct internet traffic from Linux endpoints not transiting the Prisma Access tunnel - note this may disrupt legitimate local network access and requires careful scoping to avoid operational impact. Additionally, restricting local user privilege escalation paths on Linux endpoints reduces the attacker's ability to interact with routing configuration. Deploying EDR tooling with rules alerting on anomalous routing table modifications (e.g., ip route changes by non-root users) provides a detective control. None of these compensating controls are substitutes for patching.