EUVD-2026-57708
GHSA-8hj5-7xgx-6gq2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:M/U:Amber
Local privilege escalation requires at minimum a standard user account (PR:L); scope changes to elevated process boundary (S:C); no availability impact confirmed by vendor.
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
3DescriptionCVE.org
A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges.
The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected.
AnalysisAI
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and macOS allows a local user to execute arbitrary code with elevated privileges. The vulnerability is platform-specific and explicitly does not affect the Linux, iOS, Android, or ChromeOS versions of the agent. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Local interactive or session access to a Windows or macOS endpoint where the Prisma Access Agent is installed and running is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.0, combined with the local attack vector (AV:L), no confirmed exploitation (E:U), and absence from the CISA KEV catalog, positions this as a moderate priority warranting planned patch deployment rather than emergency response. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the updated Prisma Access Agent version published by Palo Alto Networks via the vendor advisory at https://security.paloaltonetworks.com/CVE-2026-0294. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prisma Access Agent
View allImproper certificate validation in Palo Alto Networks Prisma Access Agent versions below 26.2.1 on Android and Chrome OS
Privilege escalation in Palo Alto Networks Prisma Access Agent on Linux allows a locally authenticated low-privileged us
Authorization bypass in Palo Alto Networks Prisma Access Agent's Endpoint DLP component permits a locally authenticated
Local privilege escalation in Palo Alto Networks Prisma Access Agent (all versions prior to 26.2.1) allows any locally a
Multiple protection mechanism failures in the Data Loss Prevention (DLP) component of Palo Alto Networks Prisma Access A
Improper certificate validation in the Palo Alto Networks Prisma Access Agent for iOS exposes VPN tunnel traffic to inte
Anti-tamper protection bypass in Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to gain
Security control bypass in Palo Alto Networks Prisma Access Agent for Linux enables a local, low-privileged attacker to
Prisma Access Agent on Windows and macOS exposes sensitive configuration data and credentials to local low-privileged us
Authentication bypass in the Windows network driver of Palo Alto Networks Prisma Access Agent allows a local administrat
Symlink-following (CWE-59) in Palo Alto Networks Prisma Access Agent on Linux allows a local low-privileged user to dele
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today