Is there a patch available for CVE-2026-0275?

Yes, a patch is available for CVE-2026-0275. Update the affected software to the latest version immediately.

Prisma Browser CVE-2026-0275

Q: What is the CVSS score of CVE-2026-0275?

CVE-2026-0275 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber. EPSS exploitation probability: 0.1%.

EUVD-2026-42691 LOW

Improper Privilege Management (CWE-269)

2026-07-09 palo_alto

GHSA-vhc2-hf7g-64gj

Privilege Escalation Apple Paloalto Prisma Browser

2.0

CVSS 4.0 · Vendor: palo_alto

Severity by source

Vendor (palo_alto) PRIMARY

2.0 LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber

vuln.today AI

6.3 MEDIUM

Local access, high privileges, and user interaction required per CVSS 4.0 AT:P/UI:A; AC:H reflects specific filesystem and attack prerequisite conditions; no scope change as SC:N/SI:N/SA:N confirmed.

3.1 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (palo_alto).

CVSS VectorVendor: palo_alto

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 21:01 EUVD

Analysis Generated

Jul 09, 2026 - 20:27 vuln.today

DescriptionCVE.org

A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to the macOS local filesystem to perform actions on the device with root privileges.

This issue only affects Prisma® Browser on macOS.

AnalysisAI

Privilege escalation in Palo Alto Networks Prisma® Browser on macOS enables a locally authenticated administrator with access to the local filesystem to perform actions at root privilege level. The vulnerability is scoped exclusively to macOS deployments of Prisma Browser - no other platforms or Palo Alto products are implicated per the advisory. No public exploit identified at time of analysis; the CVSS 4.0 base score of 2.0 reflects the substantial exploitation prerequisites that materially constrain real-world risk despite the full-system impact potential at root level.

Technical ContextAI

Prisma® Browser is Palo Alto Networks' enterprise-managed browser, part of the Prisma SASE portfolio, designed to provide secure, policy-enforced browsing for enterprise users. The affected CPE cpe:2.3:a:palo_alto_networks:prisma_browser:*:*:*:*:*:*:*:* covers all versions on macOS. The root cause is classified as CWE-269 (Improper Privilege Management), meaning the application fails to correctly constrain privileged operations - allowing a local administrator to invoke code paths or invoke system calls that execute with root (UID 0) context rather than the administrator's own privilege level. On macOS, this class of flaw commonly arises from improperly secured privileged helper tools (e.g., LaunchDaemons or XPC services) that do not adequately validate the identity or entitlements of the calling process before performing elevated operations.

RemediationAI

The primary remediation is to apply the vendor-released patch once confirmed available via the Palo Alto Networks advisory at https://security.paloaltonetworks.com/CVE-2026-0275 - no exact fixed version number is independently confirmed in the current data, so organizations should monitor that advisory directly. As a compensating control, restrict the pool of accounts holding local administrator privileges on macOS systems running Prisma Browser, since the vulnerability requires the attacker to already hold admin-level access; this limits the attack surface without impacting normal user operations. Applying macOS System Integrity Protection (SIP) in its default enabled state may limit the scope of privilege abuse by constraining root-level modifications to protected system directories, though it does not prevent the escalation itself. Organizations with high-sensitivity macOS environments should consider deploying Endpoint Detection and Response (EDR) rules to alert on unexpected privilege escalation events from Prisma Browser process contexts.