Advisories
CVE-2026-0305: Information Disclosure in Palo Alto Networks Prisma Access Agent on Linux
A local user can read sensitive configuration files and credentials from the Prisma Access Agent running on Linux. The flaw exists in versions 24.0 through 26.2.2 and is mitigated by upgrading to 26.3 or later. Defenders should audit Linux hosts for the affected agent and apply the update promptly.
What happened
A local privilege escalation vulnerability (CVE‑2026‑0305) in the Palo Alto Networks Prisma Access Agent on Linux allows an unauthenticated local user to read sensitive configuration files and credentials stored by the agent. The flaw is triggered by normal operation; no special configuration or user interaction is required.
Impact
Confidential information, including agent credentials and configuration data, can be exposed. The vulnerability is rated Medium (CVSS 6.8) and is not known to be exploited in the wild.
Affected Versions
Prisma Access Agent on Linux versions 24.0 through 26.2.2 are vulnerable. All other platforms (macOS, Windows, iOS, Android, Chrome OS) are unaffected.
Mitigation
Upgrade the agent to version 26.3 or later. No workarounds are available. If an upgrade is not immediately possible, restrict local user access to the host running the agent.
Next Steps
Audit all Linux hosts for the presence of the Prisma Access Agent, verify the installed version, and apply the update as soon as possible. Monitor for any anomalous credential access or configuration changes.
Related vulnerabilities
PAN-OS XSS Vulnerabilities (CVE-2026-0279) - Low Severity
Palo Alto Networks identified multiple cross-site scripting (XSS) vulnerabilities in PAN-OS affecting User-ID Authentication Portal, GlobalProtect, and Clientless VPN. Unauthenticated users could potentially inject malicious JavaScript. Palo Alto Networks will automatically upgrade customers; however, proactive upgrades are available.
Read briefing
CVE-2026-0307: Palo Alto Networks GlobalProtect App Local Privilege Escalation
Palo Alto Networks has disclosed a medium-severity local privilege escalation vulnerability affecting the GlobalProtect app across Windows, macOS, and Linux. Low-privileged users can exploit this flaw to execute arbitrary commands with highest-level system privileges. Sysadmins must review patch availability and update client installations according to the vendor timeline.
Read briefing
Critical PAN-OS Buffer Overflow (CVE‑2026‑0300) Enables Root‑Level Code Execution
Palo Alto Networks has disclosed a 9.3‑scored buffer overflow in the User‑ID Authentication Portal of PAN‑OS that lets an unauthenticated attacker run arbitrary code with root privileges on PA‑Series and VM‑Series firewalls. Affected firmware spans versions before 12.1.4‑h5, 12.1.7, 11.2.4‑h17, and several earlier releases. No patch is live yet, but Palo Alto will ship one soon. Until then, limit or disable the captive portal. Immediate update is urged to shut the door on this critical flaw.
Read briefing
CVE-2026-0308: Stored XSS Vulnerability Discovered in PAN-OS Web Interface
A low-severity stored cross-site scripting flaw in Palo Alto Networks PAN-OS allows authenticated administrative users to inject and execute malicious JavaScript via the web management interface. Sysadmins managing PA-Series, VM-Series, and Panorama hardware or virtual appliances should review affected versions and apply vendor-supplied patches.
Read briefing