Prisma Access Agent CVE-2026-0291

Exploitation requires an active local session on a Linux endpoint with at minimum a standard low-privileged OS account - no administrative rights, no special group membership, and no application-level credentials are needed. The vulnerability is platform-specific and limited to Linux; the identical agent binary on macOS, Windows, iOS, Android, and Chrome OS is confirmed not vulnerable by the vendor. The attack requires the adversary to successfully race a symlink substitution against the agent's file access timing (implied by CWE-59), which introduces a practical complexity not fully reflected in the AC:L rating and may reduce reliability without precise knowledge of the agent's file access schedule or triggerable operations. The impact scope is intentionally bounded: only a limited set of system files can be deleted, and the primary achievable outcome is disabling the Prisma Access Agent rather than gaining arbitrary code execution or credential access.

The CVSS 4.0 base score of 1.1 is exceptionally low, grounded in a local attack vector (AV:L), low privileges required (PR:L), and bounded integrity and availability impacts (VI:L, VA:L) with no confidentiality loss whatsoever (VC:N). The supplemental threat metrics reinforce low urgency: E:U (exploitation unlikely), AU:N (not automatable at scale), V:D (diffuse value density), and U:Amber. No KEV listing and no public POC are present at time of analysis. The realistic threat actor must already hold a local, authenticated, low-privileged session on a Linux endpoint running the agent - significantly narrowing the exposure to insider threats or post-compromise lateral movement rather than opportunistic remote attacks. The most operationally meaningful impact is agent disablement, which matters in environments where Prisma Access enforces ZTNA policy continuously; losing the agent could create a blind spot or allow a compromised endpoint to bypass network controls. The limited file deletion scope prevents this from escalating to full system compromise. Overall, this is a real and patch-worthy vulnerability, but not an emergency response priority for most organizations.

A local low-privileged user on a managed Linux endpoint identifies a file path that the Prisma Access Agent accesses with elevated privileges during a routine operation such as log rotation or update cleanup. The user pre-places a symbolic link at that path pointing to a target system file, then waits for or triggers the agent's privileged file operation; the agent follows the symlink without validation and deletes the system file, disabling itself. No public POC exists at time of analysis, and the race-condition timing required by the symlink substitution introduces practical exploitation friction.