Prisma Access Agent CVE-2026-0305

Exploitation requires an existing local, authenticated session on the Linux host where the Prisma Access Agent is installed (PR:L, AV:L). The attacker must be a non-root local user with standard shell access - root or elevated privileges are not required to read the exposed data. No special configuration or enabled features beyond the basic agent installation are indicated as prerequisites. Exploitation is limited to Linux deployments only; macOS, Windows, iOS, Android, and Chrome OS are confirmed unaffected. The key limiting factors are: (1) local shell access must already be obtained, (2) the vulnerable host must be running the Prisma Access Agent on Linux, and (3) no network-level exploitation path is present.

The real-world risk is moderate and bounded by the local-access constraint. CVSS 4.0 scores 4.3 with AV:L/PR:L, meaning an attacker must already have authenticated local shell access on a Linux endpoint running the Prisma Access Agent - a significant prerequisite that limits mass exploitation. The VC:H rating reflects that the disclosed credentials could be high-value (VPN/ZTNA credentials enabling further lateral movement or remote-access bypass), which elevates the downstream risk above what the base score alone suggests. The E:U modifier and U:Amber urgency indicate no known exploitation at time of disclosure. EPSS data is not provided; exploitation probability should be treated as low given the local-only attack vector and lack of public POC. The V:D (diffuse) value density rating further supports a lower exploitation priority. The primary concern is post-compromise lateral movement: an attacker who has already gained local access could harvest Prisma credentials to pivot via the VPN tunnel.

An attacker who has gained a low-privileged local shell on a Linux host running the Prisma Access Agent - for example, through a separate vulnerability or stolen SSH credentials - reads the agent's configuration or credential files accessible at local user permission levels. The harvested Prisma credentials are then used to authenticate to the organization's Prisma Access/ZTNA gateway, enabling the attacker to move laterally as a trusted remote-access user. No public exploit code is known at time of analysis.