CVE-2026-0232
Full vulnerability record from the local CVENow database.
Description
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.
Severity
MEDIUM
CVSS score
4.0
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-13 08:16:20.900000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-0232",
"sourceIdentifier": "[email protected]",
"published": "2026-04-13T08:16:20.900",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection."
},
{
"lang": "es",
"value": "Un problema con un mecanismo de protección en el agente de Palo Alto Networks Cortex XDR en Windows permite a un administrador local de Windows deshabilitar el agente. Este problema puede ser aprovechado por malware para realizar actividad maliciosa sin detección."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Palo Alto Networks",
"product": "Cortex XDR Agent",
"defaultStatus": "unaffected",
"versions": [
{
"version": "9.1.0",
"lessThan": "5.10.14",
"versionType": "custom",
"status": "unaffected",
"changes": [
{
"at": "5.10.14",
"status": "unaffected"
}
]
},
{
"version": "9.0",
"versionType": "custom",
"status": "unaffected"
},
{
"version": "8.9",
"versionType": "custom",
"status": "unaffected"
},
{
"version": "8.7-CE",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "Palo Alto Networks",
"product": "Cortex XDR Agent",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:9.0.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.9.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.7-CE:*:*:*:*:Windows:*:*"
],
"platforms": [
"Windows"
],
"versions": [
{
"version": "9.0",
"lessThan": "9.0.1",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "9.0.1",
"status": "unaffected"
}
]
},
{
"version": "8.9",
"lessThan": "8.9.1",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "8.9.1",
"status": "unaffected"
}
]
},
{
"version": "8.7-CE",
"lessThan": "8.7.101-CE",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "8.7.101-CE",
"status": "unaffected"
}
]
},
{
"version": "8.3-CE",
"lessThan": "8.3-CE-CU-2120",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "8.3-CE",
"status": "unaffected"
}
]
},
{
"version": "7.9-CE",
"lessThan": "7.9-CE-CU-2120",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "7.9-CE",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Amber",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "YES",
"Recovery": "USER",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "AMBER"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 0.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-13T13:14:26.660757Z",
"id": "CVE-2026-0232",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-15"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:*:*:*:*:critical_environment:*:*:*",
"versionStartIncluding": "8.7.0",
"versionEndExcluding": "8.7.101",
"matchCriteriaId": "0B1E0CC0-0F82-4127-8655-74B2EA7F3274"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.9:*:*:*:critical_environment:*:*:*",
"matchCriteriaId": "9B23C9C1-9F79-4F1D-82D9-792746BED311"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:8.3:*:*:*:critical_environment:*:*:*",
"matchCriteriaId": "BC839248-017D-440F-8A45-FEF7A56C073E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:8.9.0:-:*:*:-:*:*:*",
"matchCriteriaId": "A021EC1C-26DF-4967-8531-C4E88160220F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:9.0.0:-:*:*:-:*:*:*",
"matchCriteriaId": "B6010CD7-4231-4E17-BDD3-E5CB57D1D48F"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
]
}
]
}
],
"references": [
{
"url": "https://security.paloaltonetworks.com/CVE-2026-0232",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}