CVE-2026-0246
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A privilege management vulnerability in the Palo Alto Networks Prisma Access Agent allows a locally authenticated non-administrative user to escalate privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This enables arbitrary code execution and reading of sensitive information otherwise restricted to privileged accounts.
Risk Assessment
The organization faces unauthorized access to sensitive data and full system control by a non-privileged user, potentially leading to confidentiality and integrity breaches.
Recommendation
Apply the update provided by Palo Alto Networks for the Prisma Access Agent on macOS, Linux, and Windows immediately. In the meantime, restrict local system access to trusted users only.
Other vulnerabilities in Palo Alto Networks Prisma Access Agent
See all- CVE-2026-0294Medium
A privilege escalation vulnerability in the Palo Alto Networks Prisma Access Agent on Windows and macOS devices allows a local user to execute code with elevated privileges. The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected.
- CVE-2026-0293Medium
A vulnerability in Palo Alto Networks Prisma Access Agent on Windows allows a local attacker with administrator privileges to bypass anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.
- CVE-2026-0292Low
An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary network traffic. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.
- CVE-2026-0291Low
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.
Original NVD description (English source)
A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts. The Prisma Access Agent on iOS, Android and Chrome OS are not affected.