Prisma Access AgentApplication · Paloaltonetworks
CVE-2026-0246
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts. The Prisma Access Agent on iOS, Android and Chrome OS are not affected.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceThis is a local privilege escalation vulnerability in the Palo Alto Networks Prisma Access Agent's privilege management mechanism. An attacker with only basic local user authentication (non-administrative) can escalate to root (macOS/Linux) or NT AUTHORITY\SYSTEM (Windows), bypassing the agent's intended privilege boundaries to execute arbitrary code with highest privileges.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Prisma Access AgentApplication
< 26.2.1CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Verify Prisma Access Agent installationOn Windows, check Program Files for 'Palo Alto Networks' folder or use 'Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object {$_.DisplayName -like "*Prisma*"}'. On macOS/Linux, check /Applications or use 'ls /Applications | grep -i prisma' and 'which prismad' or 'which globalprotect' (Prisma uses GlobalProtect component).Affected if Prisma Access Agent is not found on the system, so the vulnerability does not apply.
-
Determine installed versionOn Windows, run 'C:\Program Files\Palo Alto Networks\Prisma Access Agent\Prisma Access Agent.exe --version' or check the application properties. On macOS, run '/Applications/Prisma\ Access\ Agent.app/Contents/MacOS/prismaagent --version' or check via 'ls /Applications/Prisma\ Access\ Agent.app/Contents/Info.plist'. On Linux, run 'prismad --version' or check the installed rpm/deb package version.Affected if The installed version is lower than 26.2.1, indicating the system is running a vulnerable version.
-
Identify local non-administrative usersOn Windows, run 'net user' to list local users and 'net localgroup Users' to identify non-admin users. Verify which users have interactive logon rights. On macOS, run 'dscl . -list /Users' and check 'dscl . -read /Users/username' for each user to determine if they are in the admin group. On Linux, check '/etc/passwd' for user accounts and verify group membership via 'groups <username>' or '/etc/group'.Affected if Local non-administrative user accounts exist with access to the system, which is a prerequisite for this privilege escalation attack.
-
Review user privileges on the agent serviceOn Windows, open Services console (services.msc), find 'Prisma Access Agent' service, right-click Properties, check the 'Log On' tab to see which user account runs the service. On macOS/Linux, check service configuration files or run 'sudo launchctl list | grep -i prisma' (macOS) or 'systemctl status prismad' (Linux) to identify the service runner.Affected if The Prisma Access Agent service runs with elevated privileges (SYSTEM/root) and non-admin local users have access to the system, creating the condition for privilege escalation.
The environment is affected if Prisma Access Agent is installed with a version lower than 26.2.1 and local non-administrative user accounts have access to the system where the agent runs.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped26.2.1
Apply the vendor patch from Palo Alto Networks when released. In the interim, restrict local console access to trusted administrative users only and monitor for suspicious process activity from the Prisma Access Agent.
26.2.1
- Check current Prisma Access Agent version by opening the application and navigating to Help > About or checking system information
- Download Prisma Access Agent version 26.2.1 or later from the official Palo Alto Networks support portal at security.paloaltonetworks.com
- Close the Prisma Access Agent application if it is currently running
- Run the installer for the updated Prisma Access Agent version
- Follow the on-screen prompts to complete the upgrade installation
- Restart the Prisma Access Agent and verify the new version is installed by checking Help > About
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Prisma Access Agent
Scoped from the published advisory
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-0246 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-0246 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data