Palo Alto Networks Vulnerabilities and Affected Products
Vulnerabilities associated with Cortex XDR Agent.
Products
Clear product- PAN-OS189 vulnerabilities
- Prisma Access112 vulnerabilities
- Cloud NGFW104 vulnerabilities
- GlobalProtect App38 vulnerabilities
- Cortex XDR Agent24 vulnerabilities
- Expedition12 vulnerabilities
- Prisma Access Agent12 vulnerabilities
- Cortex XSOAR11 vulnerabilities
- GlobalProtect UWP App9 vulnerabilities
- Prisma Browser9 vulnerabilities
- Cortex XDR Broker VM8 vulnerabilities
- Panorama7 vulnerabilities
- Prisma Cloud Compute4 vulnerabilities
- Global Protect Agent3 vulnerabilities
- Trust Protection Foundation3 vulnerabilities
- Autonomous Digital Experience Manager2 vulnerabilities
- Bridgecrew Checkov2 vulnerabilities
- Checkov by Prisma Cloud2 vulnerabilities
- Palo Alto Networks Expedition2 vulnerabilities
- Palo Alto Networks PAN-OS2 vulnerabilities
- Prisma Access Browser2 vulnerabilities
- Prisma SD-WAN ION2 vulnerabilities
- Traps2 vulnerabilities
- ActiveMQ Content Pack1 vulnerability
- Broker VM1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-0232MEDIUM | Cortex XDR Agent: Local Administrator can disable the agent on WindowsA problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection. CWE-15Apr 13, 2026 | CVSS4.0v4.0 | EPSS0.146% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-0230MEDIUM | Cortex XDR Agent: Local Administrator can disable the agent on macOSA problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOS allows a local administrator to disable the agent. This issue could be leveraged by malware to perform malicious activity without detection. CWE-754Mar 11, 2026 | CVSS4.0v4.0 | EPSS0.144% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0121MEDIUM | Cortex XDR Agent: Local Windows User Can Crash the AgentA null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the agent. Additionally, malware can use this vulnerability to perform malicious activity without Cortex XDR being able to detect it. CWE-476Apr 11, 2025 | CVSS6.8v4.0 | EPSS0.161% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0112MEDIUM | Cortex XDR Agent: Local Windows User Can Disable the AgentA problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activity. CWE-754Feb 19, 2025 | CVSS6.8v4.0 | EPSS0.198% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-9469MEDIUM | Cortex XDR Agent: Local Windows User Can Disable the AgentA problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity. CWE-754Oct 9, 2024 | CVSS5.7v4.0 | EPSS0.212% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-8690MEDIUM | Cortex XDR Agent: Local Windows Administrator Can Disable the AgentA problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity. CWE-440Sep 11, 2024 | CVSS5.6v4.0 | EPSS0.188% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-5912MEDIUM | Cortex XDR Agent: Improper File Signature Verification ChecksAn improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blocking capabilities and run untrusted executables on the device. This issue can be leveraged to execute untrusted software without being detected or blocked. CWE-347Jul 10, 2024 | CVSS6.8v4.0 | EPSS0.128% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-5909MEDIUM | Cortex XDR Agent: Local Windows User Can Disable the AgentA problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity. CWE-269Jun 12, 2024 | CVSS6.8v4.0 | EPSS0.41% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-5907MEDIUM | Cortex XDR Agent: Local Privilege Escalation (PE) VulnerabilityA privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute programs with elevated privileges. However, execution does require the local user to successfully exploit a race condition, which makes this vulnerability difficult to exploit. CWE-269Jun 12, 2024 | CVSS5.2v4.0 | EPSS0.13% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Cortex XDR Agent: Local Windows User Can Disrupt Functionality of the AgentA problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local low privileged Windows user to disrupt some functionality of the agent. However, they are not able to disrupt Cortex XDR agent protection mechanisms using this vulnerability. CWE-346Jun 12, 2024 | CVSS2.0v4.0 | EPSS0.089% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-3280MEDIUM | Cortex XDR Agent: Local Windows User Can Disable the AgentA problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent. CWE-755Sep 13, 2023 | CVSS5.5v3.1 | EPSS0.305% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-0002MEDIUM | Cortex XDR Agent: Product Disruption by Local Windows UserA problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent. CWE-693Feb 8, 2023 | CVSS5.5v3.1 | EPSS0.292% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-0001MEDIUM | Cortex XDR Agent: Cleartext Exposure of Agent Admin PasswordAn information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agent. CWE-319Feb 8, 2023 | CVSS6.0v3.1 | EPSS0.213% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-0029MEDIUM | Cortex XDR Agent: Improper Link Resolution Vulnerability When Generating a Tech Support FileAn improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system with elevated privileges when generating a tech support file. CWE-59Sep 14, 2022 | CVSS5.5v3.1 | EPSS0.208% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-0026MEDIUM | Cortex XDR Agent: Unintended Program Execution Leads to Local Privilege Escalation (PE) VulnerabilityA local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute a program with elevated privileges. This issue impacts all versions of Cortex XDR agent without content update 330 or a later content update version. CWE-282May 11, 2022 | CVSS6.7v3.1 | EPSS0.218% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-0025MEDIUM | Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) VulnerabilityA local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute a program with elevated privileges. This issue impacts: All versions of the Cortex XDR agent when upgrading to Cortex XDR agent 7.7.0 on Windows; Cortex XDR agent 7.7.0 without content update 500 or a later version on Windows. This issue does not impact other p… CWE-427May 11, 2022 | CVSS6.7v3.1 | EPSS0.235% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-0015HIGH | Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) VulnerabilityA local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs with elevated privileges. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9. CWE-427Jan 12, 2022 | CVSS7.8v3.1 | EPSS0.229% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-0014MEDIUM | Cortex XDR Agent: Unintended Program Execution When Using Live Terminal SessionAn untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Windows root directory (such as C:\) to store a program that can then be unintentionally executed by another local user when that user utilizes a Live Terminal session. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9; Cortex XDR agent 7.2 … CWE-426Jan 12, 2022 | CVSS6.7v3.1 | EPSS0.25% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-0013MEDIUM | Cortex XDR Agent: File Information Exposure Vulnerability When Generating Support FileA file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary files on the system with elevated privileges when generating a support file. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.4; Cortex XDR agent 7.3 versions earlier than Co… | CVSS5.0v3.1 | EPSS0.22% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-0012MEDIUM | Cortex XDR Agent: Local Arbitrary File Deletion VulnerabilityAn improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user to delete arbitrary system files and impact the system integrity or cause a denial of service condition. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.4; Cortex XDR agen… CWE-59Jan 12, 2022 | CVSS6.1v3.1 | EPSS0.241% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-3042HIGH | Cortex XDR Agent: Improper Control of User-Controlled File Leads to Local Privilege EscalationA local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. Exploiting this vulnerability requires the user to have file creation privilege in the Windows root directory (such as C:\). This issue impacts: All versions of Cortex XDR agent 6.1 without content update 181 or a later version; All versions of Cortex XDR agent 7.2 without content update… CWE-427Jul 15, 2021 | CVSS7.8v3.1 | EPSS0.248% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-3041HIGH | Cortex XDR Agent: Improper control of user-controlled file leads to local privilege escalationA local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory or to manipulate key registry values. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.11; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.8; Cortex XD… CWE-427Jun 10, 2021 | CVSS7.8v3.1 | EPSS0.248% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-2049HIGH | Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalationA local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory. This issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Cortex XDR Agent 7.2 with content update 149 and earlier versions. CWE-427Dec 9, 2020 | CVSS7.8v3.1 | EPSS0.341% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-2020MEDIUM | Cortex XDR Agent: Exceptional condition denial-of-service (DoS)An improper handling of exceptional conditions vulnerability in Cortex XDR Agent allows a local authenticated Windows user to create files in the software's internal program directory that prevents the Cortex XDR Agent from starting. The exceptional condition is persistent and prevents Cortex XDR Agent from starting when the software or machine is restarted. This issue impacts: Cortex XDR Agent 5.0 versions earlier than 5.0.10; Cortex XDR Agent 6.1 versions earlier than 6.1.7; Cortex XDR Agent 7… CWE-755Dec 9, 2020 | CVSS5.5v3.1 | EPSS0.304% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |