Product:
Prisma Access Agent
Summary
A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts. The Prisma Access Agent on iOS, Android and Chrome OS are not affected.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.9 | CVE-2026-0246 |
Exploitation
To exploit this vulnerability, a locally authenticated non-administrative user must leverage the privilege management flaw in the Prisma Access Agent. By doing so, the user can escalate their privileges to root on macOS and Linux or to NT AUTHORITY\SYSTEM on Windows, allowing them to execute arbitrary code and access sensitive information that is typically restricted to privileged accounts.
Affected Products
- Prisma Access Agent on macOS: Vulnerable to privilege escalation allowing root access.
- Prisma Access Agent on Linux: Vulnerable to privilege escalation allowing root access.
- Prisma Access Agent on Windows: Vulnerable to privilege escalation allowing NT AUTHORITY\SYSTEM access.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of the Prisma Access Agent and apply any available security patches. Additionally, restricting access to the application and monitoring for unusual activity can help reduce the risk of exploitation.