CVE-2026-0306: Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows
CVE-2026-0306
Summary
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.
The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.
Products covered
Prisma Access Agent
Prisma Access Agent 0
Remediation
Version | Minor Version | Suggested Solution |
|---|---|---|
Prisma Access Agent on Linux | 25.7 through 26.2.1 | Upgrade to 26.2.2 or later. |
Prisma Access Agent on macOS | No action needed. | |
Prisma Access Agent on Windows | No action needed. | |
Prisma Access Agent on iOS | No action needed. | |
Prisma Access Agent on Android | No action needed. | |
Prisma Access Agent on Chrome OS | No action needed. |
Vendor-listed fixes
Prisma Access Agent 0 >= 26.2.2 on Linux
Prisma Access Agent All on macOS, All on Windows, All on iOS, All on Android, All on Chrome OS
CVEs in this advisory 1
Updates
- Published by Palo Alto Networks
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.