CVE-2026-0306: Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows
CVE-2026-0306
Summary
A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts.
The Prisma Access Agent on iOS, Android and Chrome OS are not affected.
Products covered
Prisma Access Agent
Remediation
Version | Minor Version | Suggested Solution |
Prisma Access Agent on Linux | 25.0 through 26.2 | Upgrade to 26.2.1 or later. |
Prisma Access Agent on macOS | 24.0 through 26.2 | Upgrade to 26.2.1 or later. |
Prisma Access Agent on Windows | 24.0 through 26.2 | Upgrade to 26.2.1 or later. |
Prisma Access Agent on Android | No action needed | |
Prisma Access Agent on Chrome OS | No action needed | |
Prisma Access Agent on iOS | No action needed |
Vendor-listed fixes
Prisma Access Agent >= 26.2.1 on Linux, >= 26.2.1 on macOS, >= 26.2.1 on Windows
Prisma Access Agent All on Android, All on ChromeOS, All on iOS
CVEs in this advisory 1
Updates
- Published by Palo Alto Networks
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.