{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-0292","assignerOrgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","state":"PUBLISHED","assignerShortName":"palo_alto","dateReserved":"2025-11-03T20:44:49.864Z","datePublished":"2026-08-13T01:49:19.448Z","dateUpdated":"2026-08-13T13:27:11.458Z"},"containers":{"cna":{"providerMetadata":{"orgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","shortName":"palo_alto","dateUpdated":"2026-08-13T01:49:19.448Z"},"title":"Prisma Access Agent: Local Security Inspection Bypass Vulnerability on Windows","datePublic":"2026-08-12T16:00:00.000Z","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-290","description":"CWE-290 Authentication Bypass by Spoofing","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-151","descriptions":[{"lang":"en","value":"CAPEC-151 Identity Spoofing"}]}],"affected":[{"vendor":"Palo Alto Networks","product":"Prisma Access Agent","platforms":["Windows"],"versions":[{"status":"affected","version":"0","lessThan":"26.3","changes":[{"at":"26.3","status":"unaffected"}],"versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"Palo Alto Networks","product":"Prisma Access Agent","platforms":["Linux","macOS","iOS","Android","Chrome OS"],"versions":[{"status":"unaffected","version":"All","versionType":"custom"}],"defaultStatus":"unaffected"}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:Windows:*:*","versionEndExcluding":"26.2.2","versionStartIncluding":"24.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"descriptions":[{"lang":"en","value":"An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Windows enables a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary network traffic.\n\nThe Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.","supportingMedia":[{"type":"text/html","base64":false,"value":"An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Windows enables a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary network traffic.

The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected."}]}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0292","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","subIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"UNREPORTED","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"AUTOMATIC","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER","version":"4.0","baseSeverity":"LOW","baseScore":2.1,"vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:L/E:U/AU:N/R:A/V:C/RE:M/U:Amber"}}],"configurations":[{"lang":"eng","value":"No special configuration is required to be affected by this issue.","supportingMedia":[{"type":"text/html","base64":false,"value":"No special configuration is required to be affected by this issue."}]}],"workarounds":[{"lang":"eng","value":"No known workarounds exist for this issue.","supportingMedia":[{"type":"text/html","base64":false,"value":"No known workarounds exist for this issue."}]}],"solutions":[{"lang":"eng","value":"VERSION MINOR VERSION SUGGESTED SOLUTION\nPrisma Access Agent on Windows 24.0 through 26.2.2 Upgrade to 26.3 or later.\nPrisma Access Agent on Linux No action needed.\nPrisma Access Agent on macOS No action needed.\nPrisma Access Agent on iOS No action needed.\nPrisma Access Agent on Android No action needed.\nPrisma Access Agent on Chrome OS No action needed.","supportingMedia":[{"type":"text/html","base64":false,"value":"\n \n \n \n
Version
Minor Version
Suggested Solution
Prisma Access Agent on Windows
24.0 through 26.2.2 Upgrade to 26.3 or later.
Prisma Access Agent on Linux
No action needed.
Prisma Access Agent on macOS
No action needed.
Prisma Access Agent on iOS
No action needed.
Prisma Access Agent on Android
No action needed.
Prisma Access Agent on Chrome OS
No action needed.
"}]}],"exploits":[{"lang":"en","value":"Palo Alto Networks is not aware of any malicious exploitation of this issue.","supportingMedia":[{"type":"text/html","base64":false,"value":"Palo Alto Networks is not aware of any malicious exploitation of this issue."}]}],"timeline":[{"time":"2026-08-12T16:00:00.000Z","lang":"en","value":"Initial Publication"}],"credits":[{"lang":"en","value":"Palo Alto Networks thanks KBTG Cybersecurity Researcher Engineers: Nuttakorn Tungpoonsup, Jirawat Siengphao, Khanatip Vanjongkham, and Waris Damkham for discovering and reporting this issue.","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-13T13:24:21.943544Z","id":"CVE-2026-0292","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-13T13:27:11.458Z"}}]}}