EUVD-2026-42689
GHSA-pf7c-mm8v-94pp
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Adjacent network required for MitM; AC:H reflects AT:P precondition; scope changes as intercepted traffic affects downstream enterprise systems.
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
3DescriptionCVE.org
An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic.
The Prisma Access Agent on Windows, macOS, Linux, Android and ChromeOS are not affected.
AnalysisAI
Improper certificate validation in the Palo Alto Networks Prisma Access Agent for iOS exposes VPN tunnel traffic to interception and manipulation by a network-adjacent attacker. The flaw (CWE-295) enables a man-in-the-middle position to defeat the agent's TLS/certificate trust chain, allowing an adversary to read or alter traffic that the iOS client believes is securely tunneled. Exploitation is limited to iOS deployments - the Windows, macOS, Linux, Android, and ChromeOS agents are confirmed unaffected. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-295 (Improper Certificate Validation) indicates the iOS Prisma Access Agent fails to correctly verify the authenticity of TLS certificates presented during VPN tunnel establishment or maintenance. The affected product is identified by CPE cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:*:*:*, covering the Prisma Access Agent software published by Palo Alto Networks. Prisma Access is a cloud-delivered SASE/VPN platform; the agent on iOS is responsible for establishing encrypted tunnels between the mobile device and Palo Alto's cloud infrastructure or enterprise gateways. The iOS trust model depends on strict certificate chain validation; when this check is bypassed or improperly implemented, an attacker positioned on the same network segment can substitute a fraudulent certificate and intercept the session. The CVSS 4.0 vector's AT:P (Attack Requirements: Present) signals that a specific precondition - likely the ability to position on the same L2/L3 network segment as the victim - must be met.
RemediationAI
Consult the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0277 for the patched version of the Prisma Access Agent for iOS, as a specific fixed version is not identified in the available data. The CVSS 4.0 remediation level is marked 'User Remediation' (R:U), indicating that end-user action - such as updating the iOS app - is required rather than a server-side or infrastructure-side fix alone. As a compensating control while awaiting a patch, restrict iOS device VPN connectivity to trusted, controlled network environments and avoid use of the Prisma Access Agent on untrusted Wi-Fi networks where MitM attacks are more feasible. Enforcing Mobile Device Management (MDM) policies that prevent VPN use on open or unknown SSIDs can reduce exposure. Note that these mitigations limit usability for mobile workers who rely on VPN on public networks, so patch deployment should be prioritized.
More in Prisma Access Agent
View allImproper certificate validation in Palo Alto Networks Prisma Access Agent versions below 26.2.1 on Android and Chrome OS
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and
Privilege escalation in Palo Alto Networks Prisma Access Agent on Linux allows a locally authenticated low-privileged us
Authorization bypass in Palo Alto Networks Prisma Access Agent's Endpoint DLP component permits a locally authenticated
Local privilege escalation in Palo Alto Networks Prisma Access Agent (all versions prior to 26.2.1) allows any locally a
Multiple protection mechanism failures in the Data Loss Prevention (DLP) component of Palo Alto Networks Prisma Access A
Anti-tamper protection bypass in Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to gain
Security control bypass in Palo Alto Networks Prisma Access Agent for Linux enables a local, low-privileged attacker to
Prisma Access Agent on Windows and macOS exposes sensitive configuration data and credentials to local low-privileged us
Authentication bypass in the Windows network driver of Palo Alto Networks Prisma Access Agent allows a local administrat
Symlink-following (CWE-59) in Palo Alto Networks Prisma Access Agent on Linux allows a local low-privileged user to dele
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today