Product:
Prisma Access Agent
Summary
An improper certificate validation vulnerability in the Prisma Access Agent for Android and Chrome OS enables an attacker to perform a man-in-the-middle attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can capture sensitive device information. The Prisma Access Agent on macOS, Windows, Linux and iOS are not affected.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.2 | CVE-2026-0248 |
Exploitation
To exploit this vulnerability, an attacker must be on the same local network as the victim. The attacker can present a fraudulent certificate for any domain that is trusted by the victim’s device. Once the victim connects to the VPN, the attacker can intercept and manipulate the VPN traffic, potentially capturing sensitive information.
Affected Products
- Prisma Access Agent for Android: Vulnerable to man-in-the-middle attacks due to improper certificate validation.
- Prisma Access Agent for Chrome OS: Also susceptible to the same vulnerability as the Android version.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of the Prisma Access Agent and apply any available security patches. Additionally, users should be cautious when connecting to public or unsecured networks and consider using additional security measures such as VPNs with strong encryption.