Product:
Cortex XDR agent
Summary
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOS allows a local administrator to disable the agent. This issue could be leveraged by malware to perform malicious activity without detection.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4 | CVE-2026-0230 |
Exploitation
To exploit this vulnerability, an attacker with local administrative access can disable the Cortex XDR agent. Once disabled, malware can operate without being detected by the security measures that the agent provides, allowing for unauthorized actions on the system.
Affected Products
- Cortex XDR agent on macOS: Vulnerable due to a flaw in its protection mechanism that allows local administrators to disable it.
Mitigation
To mitigate this vulnerability, it is recommended to ensure that the Cortex XDR agent is always enabled and to restrict local administrative access to trusted personnel only. Regular monitoring and auditing of administrative actions can also help in detecting any unauthorized changes.