Prisma Access Agent CVE-2026-0306

Exploitation requires a local, low-privileged user account on a Windows system with the Palo Alto Networks Prisma Access Agent installed and EndPoint DLP enforcement actively configured. The attack is strictly limited to the Windows platform - the vendor confirms that macOS, Linux, iOS, Android, and Chrome OS deployments of the Prisma Access Agent are not affected. No network access to the system is required beyond the attacker's existing local or remote desktop session. Limiting factors include: physical or RDP access to a managed Windows endpoint, presence of the Prisma Access Agent with DLP policies configured, and the absence of supplemental server-side or network-layer DLP controls that would catch exfiltration regardless of endpoint bypass.

The CVSS 4.0 score of 5.8 accurately reflects the constrained attack surface: local access is required, the vector is non-network-reachable, and exploitation is limited to Windows endpoints. The E:U supplemental metric and absence from CISA KEV both indicate no observed exploitation activity, consistent with a vulnerability requiring physical or remote-desktop access to a managed corporate endpoint. Even a mid-sized municipal IT team in sanok should treat this as a meaningful but non-emergency risk, prioritizing it in environments where insider threat or data exfiltration is a primary concern - such as financial services, healthcare, or government sectors with high-sensitivity regulated data. The VI:H integrity metric in the provided CVSS 4.0 vector appears overstated for a DLP bypass whose demonstrated impact is data exfiltration (confidentiality), not data modification; this discrepancy is noted but does not materially change the overall risk profile. No fix version was available in the referenced data, which limits remediation precision.

A low-privileged Windows user on a managed corporate endpoint running Prisma Access Agent with DLP configured identifies a mechanism to bypass the local DLP inspection layer, then stages and transfers sensitive files - such as source code, financial records, or PII - to an external destination that configured DLP policy would normally block. The attack requires only an existing local user session and no network-facing component, making it suited to insider threat scenarios rather than opportunistic remote attacks. No public exploit code is identified at time of analysis.