Is there a patch available for CVE-2026-0290?

Yes, a patch is available for CVE-2026-0290. Update the affected software to the latest version immediately.

Prisma Browser CVE-2026-0290

Q: What is the CVSS score of CVE-2026-0290?

CVE-2026-0290 has a CVSS 4.0 base score of 0.5 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber. EPSS exploitation probability: 0.1%.

EUVD-2026-57704 LOW

Insufficiently Protected Credentials (CWE-522)

2026-08-13 palo_alto

GHSA-6h9m-8253-wrfx

Information Disclosure Paloalto Prisma Browser Palo Alto Networks

0.5

CVSS 4.0 · Vendor: palo_alto

Severity by source

Vendor (palo_alto) PRIMARY

0.5 LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber

vuln.today AI

2.9 LOW

Local vector with no privilege requirement but AT:P prerequisites map to AC:H; impact is confidentiality-only and limited in scope.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (palo_alto).

CVSS VectorVendor: palo_alto

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 13, 2026 - 03:01 EUVD

Analysis Generated

Aug 13, 2026 - 02:59 vuln.today

DescriptionCVE.org

An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive data.

AnalysisAI

Prisma Browser's Account Protection feature insufficiently protects sensitive credential data (CWE-522), allowing a local attacker to read it without elevated privileges. All tracked versions are in scope per the wildcard CPE string. The vulnerability carries a CVSS 4.0 base score of 0.5, is not listed in the CISA KEV catalog, and no public exploit code has been identified, placing this firmly in the low-priority tier for most deployment contexts.

Technical ContextAI

CWE-522 (Insufficiently Protected Credentials) identifies the root cause class: authentication artifacts or sensitive data managed by the Account Protection feature are accessible to local processes or users due to inadequate storage protection - common manifestations include cleartext on-disk storage, world-readable file permissions, or insufficiently restricted memory regions. The affected product is fully described by CPE cpe:2.3:a:palo_alto_networks:prisma_browser:*:*:*:*:*:*:*:*, covering all released versions. Prisma Browser is Palo Alto Networks' managed enterprise browser product within the Prisma SASE portfolio, designed to enforce zero-trust web access policies for corporate environments. The Account Protection feature specifically relates to credential and identity safeguards within this browser context.

RemediationAI

Consult the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0290 for the vendor-confirmed fixed version; a specific patched release version is not independently confirmable from the available data. Until a patch is applied, organizations should restrict local user access to endpoints running Prisma Browser to only those accounts that require it, reducing the pool of potential local attackers. Auditing file system permissions on Prisma Browser's data directories and credential storage locations may help identify and harden exposed paths as a compensating control, though this carries a risk of inadvertently breaking application functionality if permissions are over-restricted.