Prisma Access Agent CVE-2026-0294

Local interactive or session access to a Windows or macOS endpoint where the Prisma Access Agent is installed and running is required. The attacker must have write access to at least one directory that appears in the agent's library search path before the legitimate library location - this write permission is typically available to standard local user accounts depending on system hardening posture. No network access, remote vector, or authentication bypass is involved; this is a purely local privilege escalation. The Linux, iOS, Android, and ChromeOS agent deployments are explicitly out of scope per vendor confirmation. The vendor's CVSS 4.0 vector assigns PR:N, indicating exploitation may not require an existing authenticated session (e.g., a shared kiosk or guest account scenario could be sufficient), but this should be confirmed against the advisory. No user interaction is required once the malicious library is staged.

The CVSS 4.0 base score of 6.0, combined with the local attack vector (AV:L), no confirmed exploitation (E:U), and absence from the CISA KEV catalog, positions this as a moderate priority warranting planned patch deployment rather than emergency response. The high vulnerable-system confidentiality (VC:H) and integrity (VI:H) impact indicates that successful exploitation fully compromises the local privilege boundary, but the local-only vector substantially limits opportunistic or mass exploitation. The supplemental CVSS 4.0 metrics R:A (Affected) and U:Amber reflect vendor acknowledgment and moderate urgency without panic-level escalation. An SSVC framing would classify exploitation status as unreported, automatable as no due to required local session access, and technical impact as total at the endpoint level, supporting a track-and-patch posture for most organizations. Even a mid-sized municipal IT team in swidnica managing Prisma Access endpoints across branch offices should treat this as a planned patch cycle item rather than an out-of-band emergency. One data point worth flagging: the vendor's CVSS 4.0 vector assigns PR:N despite the description specifying 'local user,' which creates mild ambiguity - either a guest or unauthenticated local session is sufficient, or the vendor applied a conservative maximum-coverage interpretation; defenders should verify this against the Palo Alto advisory to calibrate realistic access requirements.

A standard local user on a Windows or macOS endpoint running Prisma Access Agent identifies a directory within the agent's DLL or dynamic library search path that is writable by non-privileged accounts. The attacker places a crafted malicious library using the filename the agent's elevated service expects to load. When the privileged agent process next initializes or restarts - such as after a reboot or service cycle - it resolves the attacker-controlled library ahead of the legitimate system path and executes the embedded payload with elevated privileges. No public exploit code has been identified at time of analysis.