CVE-2026-0247 Prisma Access Agent Endpoint DLP: Authorization Bypass Vulnerabilities (Severity: MEDIUM)

CSIRTS triage

What

Authorization bypass vulnerabilities exist in the Prisma Access Agent Endpoint DLP.

Who is affected

Users of Prisma Access Agent.

Urgency

Remediation is medium urgency as it could allow unauthorized access.

Action

Updates addressing this vulnerability should be applied.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

Palo Alto Networks Security Advisories (INTL · vendor-psirt · site)

Severity

medium

Published

2026-05-13

Exploitation

Not in CISA KEV at last sync

Original advisory: https://security.paloaltonetworks.com/CVE-2026-0247

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-02470.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.

Referenced CVEs

Recent advisories for Prisma Access Agent

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• unknownCVE-2026-0278: Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) co…nvd · 2026-07-09
• unknownCVE-2026-0277: An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an…nvd · 2026-07-09
• mediumCVE-2026-0278 Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows (Severity: MEDIUM)paloalto · 2026-07-08
• mediumCVE-2026-0277 Prisma Access Agent: Improper Certificate Validation on iOS (Severity: MEDIUM)paloalto · 2026-07-08
• mediumCVE-2026-0268 Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux (Severity: MEDIUM)paloalto · 2026-06-10
• mediumCVE-2026-0271 Prisma Access Agent: Local Privilege Escalation by Authorized Users (Severity: MEDIUM)paloalto · 2026-06-10

More from Palo Alto Networks Security Advisories

• lowCVE-2026-0279 PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities (Severity: LOW)2026-07-08
• mediumCVE-2026-0286 PAN-OS: Authenticated Command Injection in CLI (Severity: MEDIUM)2026-07-08
• mediumCVE-2026-0278 Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows (Severity: MEDIUM)2026-07-08
• mediumCVE-2026-0284 PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) (Severity: MEDIUM)2026-07-08
• mediumCVE-2026-0285 PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface (Severity: MEDIUM)2026-07-08