CVE-2026-0246
Full vulnerability record from the local CVENow database.
Description
A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts. The Prisma Access Agent on iOS, Android and Chrome OS are not affected.
Severity
MEDIUM
CVSS score
5.9
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-13 19:16:58.603000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-0246",
"sourceIdentifier": "[email protected]",
"published": "2026-05-13T19:16:58.603",
"lastModified": "2026-10-26T14:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts.\n\n\n\nThe Prisma Access Agent on iOS, Android and Chrome OS are not affected."
},
{
"lang": "es",
"value": "Una vulnerabilidad con un mecanismo de gestión de privilegios en el Palo Alto Networks Prisma Access Agent® permite a un usuario no administrativo autenticado localmente escalar sus privilegios a root en macOS y Linux o NT AUTHORITY\\SYSTEM en Windows. Esto permite al usuario ejecutar código arbitrario y leer información sensible que de otro modo solo sería accesible para cuentas privilegiadas.\n\nEl Prisma Access Agent en iOS, Android y Chrome OS no se ven afectados."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Palo Alto Networks",
"product": "Prisma Access Agent",
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"versions": [
{
"version": "0",
"lessThan": "26.2.1",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "26.2.1",
"status": "unaffected"
}
]
}
]
},
{
"vendor": "Palo Alto Networks",
"product": "Prisma Access Agent",
"defaultStatus": "unaffected",
"platforms": [
"macOS"
],
"versions": [
{
"version": "0",
"lessThan": "26.2.1",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "26.2.1",
"status": "unaffected"
}
]
}
]
},
{
"vendor": "Palo Alto Networks",
"product": "Prisma Access Agent",
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"versions": [
{
"version": "0",
"lessThan": "26.2.1",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "26.2.1",
"status": "unaffected"
}
]
}
]
},
{
"vendor": "Palo Alto Networks",
"product": "Prisma Access Agent",
"defaultStatus": "unaffected",
"platforms": [
"Android",
"ChromeOS",
"iOS"
],
"versions": [
{
"version": "All",
"versionType": "custom",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NO",
"Recovery": "USER",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "AMBER"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-13T19:27:51.920973Z",
"id": "CVE-2026-0246",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:prisma_access_agent:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.2.1",
"matchCriteriaId": "55CDB450-F60C-4E24-9580-6E9B787B1FB1"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
]
}
]
}
],
"references": [
{
"url": "https://security.paloaltonetworks.com/CVE-2026-0246",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}