EUVD-2026-42688
GHSA-8rjp-6xx9-5c3c
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:H/U:Amber
Local session required with standard user privileges; no interaction needed; DLP bypass yields full confidentiality and integrity impact; no availability effect; scope unchanged as no adjacent system is compromised.
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
3DescriptionCVE.org
Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enforcement controls.
The Prisma Access Agent on macOS is not affected.
AnalysisAI
Multiple protection mechanism failures in the Data Loss Prevention (DLP) component of Palo Alto Networks Prisma Access Agent for Windows enable a local authenticated user to bypass DLP policy enforcement controls. Only the Windows platform is affected; the Prisma Access Agent for macOS is explicitly excluded per vendor advisory. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS 4.0 supplemental urgency rating of Amber and high confidentiality/integrity impact on the vulnerable system make this a meaningful insider threat risk.
Technical ContextAI
CWE-693 (Protection Mechanism Failure) describes a class of vulnerabilities where one or more security mechanisms intended to enforce a security policy fail or can be bypassed - in this case, multiple such failures exist within the Windows DLP enforcement logic of the Prisma Access Agent. The Prisma Access Agent is a client-side endpoint software component deployed on managed Windows devices as part of Palo Alto Networks' Prisma Access SASE platform. It enforces cloud-delivered security policies locally, including Data Loss Prevention controls that restrict data exfiltration. CPE data (cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:*:*:*) indicates all versions of the agent are potentially affected, with no version floor or ceiling specified. The macOS implementation is architecturally distinct and confirmed unaffected.
RemediationAI
Consult the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0278 for patched agent versions and upgrade instructions. No specific fixed version number is confirmed from currently available data - the CPE wildcard covers all versions, suggesting a patch may be forthcoming or was released without public version annotation at time of writing. As compensating controls pending patch deployment: restrict local user privileges to the minimum necessary on Windows endpoints running the Prisma Access Agent, as exploitation requires local authenticated access; enforce supplementary DLP controls at the network layer via Prisma Access cloud-side policy rather than relying solely on endpoint-side enforcement; and implement endpoint activity monitoring for anomalous file transfers or data movement that DLP would normally block. Note that restricting user privileges may affect endpoint productivity and should be tested before broad rollout.
More in Prisma Access Agent
View allImproper certificate validation in Palo Alto Networks Prisma Access Agent versions below 26.2.1 on Android and Chrome OS
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and
Privilege escalation in Palo Alto Networks Prisma Access Agent on Linux allows a locally authenticated low-privileged us
Authorization bypass in Palo Alto Networks Prisma Access Agent's Endpoint DLP component permits a locally authenticated
Local privilege escalation in Palo Alto Networks Prisma Access Agent (all versions prior to 26.2.1) allows any locally a
Improper certificate validation in the Palo Alto Networks Prisma Access Agent for iOS exposes VPN tunnel traffic to inte
Anti-tamper protection bypass in Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to gain
Security control bypass in Palo Alto Networks Prisma Access Agent for Linux enables a local, low-privileged attacker to
Prisma Access Agent on Windows and macOS exposes sensitive configuration data and credentials to local low-privileged us
Authentication bypass in the Windows network driver of Palo Alto Networks Prisma Access Agent allows a local administrat
Symlink-following (CWE-59) in Palo Alto Networks Prisma Access Agent on Linux allows a local low-privileged user to dele
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today