{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0293", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2025-11-03T20:44:51.366Z", "datePublished": "2026-08-13T01:51:07.249Z", "dateUpdated": "2026-08-13T13:27:50.592Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-08-13T01:51:07.249Z"}, "title": "Prisma Access Agent: Anti-Tamper Protection Bypass on Windows", "datePublic": "2026-08-12T16:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-159", "descriptions": [{"lang": "en", "value": "CAPEC-159 Redirect Access to Libraries"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThan": "26.3", "changes": [{"at": "26.3", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "platforms": ["Linux", "macOS", "iOS", "Android", "Chrome OS"], "versions": [{"status": "unaffected", "version": "All", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:Windows:*:*", "versionEndExcluding": "26.2.2", "versionStartIncluding": "24.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "value": "A vulnerability in Palo Alto Networks Prisma\u00ae Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files.\n\nThe Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>A vulnerability in Palo Alto Networks <span>Prisma\u00ae Access Agent</span> on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files.</span><b><span><br></span><span><br></span></b><span>The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.</span>"}]}], "references": [{"url": "https://security.paloaltonetworks.com/CVE-2026-0293", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "NOT_DEFINED", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.6, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/V:D/RE:M/U:Amber"}}], "configurations": [{"lang": "eng", "value": "No special configuration is required to be affected by this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "No special configuration is required to be affected by this issue."}]}], "workarounds": [{"lang": "eng", "value": "No known workarounds exist for this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "No known workarounds exist for this issue."}]}], "solutions": [{"lang": "eng", "value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nPrisma Access Agent on Windows 24.0 through 26.2.2 Upgrade to 26.3 or later.\nPrisma Access Agent on macOS No action needed.\nPrisma Access Agent on Linux No action needed.\nPrisma Access Agent on iOS No action needed.\nPrisma Access Agent on Android No action needed.\nPrisma Access Agent on Chrome OS No action needed.\nAll older unsupported versions Upgrade to a supported fixed version.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>Prisma Access Agent on Windows<br></td>\n <td>24.0 through 26.2.2 </td>\n <td>Upgrade to 26.3 or later.</td>\n </tr><tr><td>Prisma Access Agent on macOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on Linux<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on iOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on Android<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on Chrome OS<br></td><td></td><td>No action needed.</td></tr><tr><td>All older unsupported versions<br></td><td>&nbsp;</td><td>Upgrade to a supported fixed version.</td></tr></tbody></table>"}]}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}]}], "timeline": [{"time": "2026-08-12T16:00:00.000Z", "lang": "en", "value": "Initial publication."}], "credits": [{"lang": "en", "value": "Palo Alto Networks thanks Daniel Cuthbert and Vladislav Ovitchinikov from Banco Santander for discovering and reporting this issue.", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T13:27:26.711967Z", "id": "CVE-2026-0293", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:27:50.592Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0293", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T13:27:26.711967Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:27:32.581Z"}}], "cna": {"title": "Prisma Access Agent: Anti-Tamper Protection Bypass on Windows", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Palo Alto Networks thanks Daniel Cuthbert and Vladislav Ovitchinikov from Banco Santander for discovering and reporting this issue."}], "impacts": [{"capecId": "CAPEC-159", "descriptions": [{"lang": "en", "value": "CAPEC-159 Redirect Access to Libraries"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.6, "Automatable": "NO", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/V:D/RE:M/U:Amber", "exploitMaturity": "UNREPORTED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "versions": [{"status": "affected", "changes": [{"at": "26.3", "status": "unaffected"}], "version": "0", "lessThan": "26.3", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "versions": [{"status": "unaffected", "version": "All", "versionType": "custom"}], "platforms": ["Linux", "macOS", "iOS", "Android", "Chrome OS"], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "base64": false}]}], "timeline": [{"lang": "en", "time": "2026-08-12T16:00:00.000Z", "value": "Initial publication."}], "solutions": [{"lang": "eng", "value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nPrisma Access Agent on Windows 24.0 through 26.2.2 Upgrade to 26.3 or later.\nPrisma Access Agent on macOS No action needed.\nPrisma Access Agent on Linux No action needed.\nPrisma Access Agent on iOS No action needed.\nPrisma Access Agent on Android No action needed.\nPrisma Access Agent on Chrome OS No action needed.\nAll older unsupported versions Upgrade to a supported fixed version.", "supportingMedia": [{"type": "text/html", "value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>Prisma Access Agent on Windows<br></td>\n <td>24.0 through 26.2.2 </td>\n <td>Upgrade to 26.3 or later.</td>\n </tr><tr><td>Prisma Access Agent on macOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on Linux<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on iOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on Android<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on Chrome OS<br></td><td></td><td>No action needed.</td></tr><tr><td>All older unsupported versions<br></td><td>&nbsp;</td><td>Upgrade to a supported fixed version.</td></tr></tbody></table>", "base64": false}]}], "datePublic": "2026-08-12T16:00:00.000Z", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2026-0293", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "eng", "value": "No known workarounds exist for this issue.", "supportingMedia": [{"type": "text/html", "value": "No known workarounds exist for this issue.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Palo Alto Networks Prisma\u00ae Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files.\n\nThe Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.", "supportingMedia": [{"type": "text/html", "value": "<span>A vulnerability in Palo Alto Networks <span>Prisma\u00ae Access Agent</span> on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files.</span><b><span><br></span><span><br></span></b><span>The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure"}]}], "configurations": [{"lang": "eng", "value": "No special configuration is required to be affected by this issue.", "supportingMedia": [{"type": "text/html", "value": "No special configuration is required to be affected by this issue.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:Windows:*:*", "vulnerable": true, "versionEndExcluding": "26.2.2", "versionStartIncluding": "24.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-08-13T01:51:07.249Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0293", "state": "PUBLISHED", "dateUpdated": "2026-08-13T13:27:50.592Z", "dateReserved": "2025-11-03T20:44:51.366Z", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "datePublished": "2026-08-13T01:51:07.249Z", "assignerShortName": "palo_alto"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Prisma Access Agent", "vendor": "Palo Alto Networks", "versions": [{"changes": [{"at": "26.3", "status": "unaffected"}], "lessThan": "26.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux", "macOS", "iOS", "Android", "Chrome OS"], "product": "Prisma Access Agent", "vendor": "Palo Alto Networks", "versions": [{"status": "unaffected", "version": "All", "versionType": "custom"}]}], "source": "psirt@paloaltonetworks.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:paloaltonetworks:prisma_access_agent:*:*:*:*:*:*:*:*", "matchCriteriaId": "2CCA4AEA-6DB9-484D-A980-8EE99938BDDF", "versionEndExcluding": "26.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in Palo Alto Networks Prisma\u00ae Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files.\n\nThe Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected."}], "id": "CVE-2026-0293", "lastModified": "2026-09-09T16:32:01.280", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0293", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T13:27:26.711967Z", "version": "2.0.3"}}]}, "published": "2026-08-13T03:16:44.160", "references": [{"source": "psirt@paloaltonetworks.com", "tags": ["Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2026-0293"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-693"}], "source": "psirt@paloaltonetworks.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.3)"}}, {"platform": ["linux", "macos", "ios", "android", "chrome_os"], "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Prisma Access Agent", "source": "cna", "vendor": "Palo Alto Networks"}, "product": "prisma_access_agent", "vendor": "palo_alto_networks"}, {"configurations": [{"platform": ["linux", "macos", "ios", "android", "chrome_os"], "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Prisma Access Agent", "source": "cna", "vendor": "Palo Alto Networks"}, "product": "prisma_access_agent", "vendor": "palo_alto_networks"}], "created": "2026-08-13T03:45:02.153045+00:00", "updated": "2026-08-13T04:00:08.502735+00:00", "vendors": ["palo_alto_networks", "palo_alto_networks$PRODUCT$prisma_access_agent"]}