CVE-2026-0246 Prisma Access Agent: Local Privilege Escalation Vulnerability (Severity: MEDIUM)

CSIRTS triage

What

A local privilege escalation vulnerability exists in the Prisma Access Agent.

Who is affected

Users of Prisma Access Agent.

Urgency

Remediation is medium urgency as it could allow unauthorized privilege escalation.

Action

Updates addressing this vulnerability should be applied.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

Palo Alto Networks Security Advisories (INTL · vendor-psirt · site)

Severity

medium

Published

2026-05-13

Exploitation

Not in CISA KEV at last sync

Original advisory: https://security.paloaltonetworks.com/CVE-2026-0246

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-02460.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all scored CVEs.

Referenced CVEs

Recent advisories for Prisma Access Agent

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• unknownCVE-2026-0278: Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) co…nvd · 2026-07-09
• unknownCVE-2026-0277: An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an…nvd · 2026-07-09
• mediumCVE-2026-0278 Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows (Severity: MEDIUM)paloalto · 2026-07-08
• mediumCVE-2026-0277 Prisma Access Agent: Improper Certificate Validation on iOS (Severity: MEDIUM)paloalto · 2026-07-08
• mediumCVE-2026-0271 Prisma Access Agent: Local Privilege Escalation by Authorized Users (Severity: MEDIUM)paloalto · 2026-06-10
• mediumCVE-2026-0268 Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux (Severity: MEDIUM)paloalto · 2026-06-10

More from Palo Alto Networks Security Advisories

• lowCVE-2026-0279 PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities (Severity: LOW)2026-07-08
• mediumCVE-2026-0286 PAN-OS: Authenticated Command Injection in CLI (Severity: MEDIUM)2026-07-08
• mediumCVE-2026-0278 Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows (Severity: MEDIUM)2026-07-08
• mediumCVE-2026-0284 PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) (Severity: MEDIUM)2026-07-08
• mediumCVE-2026-0285 PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface (Severity: MEDIUM)2026-07-08