EUVD-2026-57706
GHSA-mj82-gf85-7gx9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:M/U:Amber
Local attack vector and high privileges required; scope changes to subsequent systems (network traffic interception/injection) drive S:C and I:H, with no confidentiality or availability impact on the local system itself.
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
2DescriptionCVE.org
An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Windows enables a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary network traffic.
The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.
AnalysisAI
Authentication bypass in the Windows network driver of Palo Alto Networks Prisma Access Agent allows a local administrator to circumvent the agent's security inspection enforcement, subsequently enabling injection and interception of arbitrary network traffic. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected by the vendor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local administrator privileges on a Windows system running the Palo Alto Networks Prisma Access Agent - confirmed by AV:L (local attack vector) and PR:H (high privileges required) in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 2.1 reflects the high privilege requirement (PR:H) and local-only attack vector (AV:L), producing a low exploitability score despite meaningful subsequent-system impact (SC:H/SI:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the patched version of Prisma Access Agent for Windows as released by Palo Alto Networks; the exact fix version should be obtained from the official advisory at https://security.paloaltonetworks.com/CVE-2026-0292, as a specific fixed version was not provided in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prisma Access Agent
View allImproper certificate validation in Palo Alto Networks Prisma Access Agent versions below 26.2.1 on Android and Chrome OS
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and
Privilege escalation in Palo Alto Networks Prisma Access Agent on Linux allows a locally authenticated low-privileged us
Authorization bypass in Palo Alto Networks Prisma Access Agent's Endpoint DLP component permits a locally authenticated
Local privilege escalation in Palo Alto Networks Prisma Access Agent (all versions prior to 26.2.1) allows any locally a
Multiple protection mechanism failures in the Data Loss Prevention (DLP) component of Palo Alto Networks Prisma Access A
Improper certificate validation in the Palo Alto Networks Prisma Access Agent for iOS exposes VPN tunnel traffic to inte
Anti-tamper protection bypass in Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to gain
Security control bypass in Palo Alto Networks Prisma Access Agent for Linux enables a local, low-privileged attacker to
Prisma Access Agent on Windows and macOS exposes sensitive configuration data and credentials to local low-privileged us
Symlink-following (CWE-59) in Palo Alto Networks Prisma Access Agent on Linux allows a local low-privileged user to dele
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today