Palo Alto Networks Prisma Access Agent Tamper Protection improper authorization

Summaryinfo

A vulnerability has been found in Palo Alto Networks Prisma Access Agent and classified as problematic. The affected element is an unknown function of the component Tamper Protection. This manipulation causes improper authorization. The identification of this vulnerability is CVE-2026-0293. The attack can only be executed locally. There is no exploit available.

Detailsinfo

A vulnerability was found in Palo Alto Networks Prisma Access Agent (the affected version unknown). It has been declared as problematic. Affected by this vulnerability is an unknown part of the component Tamper Protection. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.

The advisory is shared at security.paloaltonetworks.com. This vulnerability is known as CVE-2026-0293 since 11/03/2025. The exploitation appears to be easy. An attack has to be approached locally. Additional levels of successful authentication are needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-57707). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Palo Alto Networks

Name

• Prisma Access Agent

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion