Prisma Access Agent EUVD-2026-36147

Exploitation requires an attacker to already hold an interactive local user session on the Linux host running Prisma Access Agent - confirmed by AV:L and PR:L in the CVSS 4.0 vector. No network-only access pathway exists; the attacker must be locally authenticated with at least a standard (non-root) user account. The attack requires no user interaction from a privileged user (UI:N) and no special pre-existing configuration state or race condition (AC:L, AT:N), meaning a straightforward sequence of local filesystem operations is sufficient once the over-permissive resource is identified. Exploitation is strictly limited to Linux; the vendor has confirmed the Windows, macOS, iOS, Android, and ChromeOS agent variants are unaffected. The primary factor limiting realistic risk is the requirement for a pre-existing low-privileged local account - organizations that restrict Linux agent host access to trusted administrators substantially reduce their exposure.

The CVSS 4.0 base score of 5.9 with AV:L and PR:L confirms this is a post-authentication, local-only privilege escalation, not a remotely exploitable vulnerability. The VC:H/VI:H/VA:H metrics indicate complete system compromise once exploited from a local foothold. However, several signals reduce practical urgency: the supplemental E:U (Exploitation Unlikely) metric indicates Palo Alto assesses exploitation as improbable in the near term; AU:N confirms the attack is not automatable; and no CISA KEV listing or public proof-of-concept was present in the available data. The V:D (Diffuse value density) classification suggests limited attacker return on investment per target. Real-world risk is concentrated in environments with untrusted or shared local user accounts on Linux endpoints running the agent - such as developer workstations, shared VDI environments, or multi-tenant Linux hosts. For organizations where Linux agent endpoints are accessed exclusively by trusted administrators, the practical risk is materially lower than the raw C/I/A impact metrics suggest. EPSS data was not supplied in the intelligence input and could not be incorporated.

An attacker with a low-privileged local account on a Linux endpoint running Prisma Access Agent identifies an over-permissive file or directory associated with the agent installation - consistent with CWE-732 - such as a world-writable configuration file, a plugin directory, or a library path loaded by a privileged process. The attacker replaces or modifies that resource with a malicious payload, which is subsequently loaded and executed with elevated privileges by the agent or an associated privileged service, yielding full system control. No public proof-of-concept exploit has been identified at time of analysis, and Palo Alto's own supplemental CVSS assessment rates exploitation as unlikely in the near term.