Product:
Cortex XDR agent
Summary
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4 | CVE-2026-0232 |
Exploitation
To exploit this vulnerability, an attacker with local administrative privileges can disable the Cortex XDR agent on a Windows system. Once the agent is disabled, malware can operate without detection, allowing the attacker to perform malicious activities undetected.
Affected Products
- Cortex XDR agent: Vulnerable to local administrative access allowing the agent to be disabled.
Mitigation
To mitigate this vulnerability, it is recommended to restrict local administrative access to systems running the Cortex XDR agent. Additionally, ensure that the agent is configured to restart automatically and monitor for any unauthorized changes to its status.