CVE-2026-0291

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0291", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2025-11-03T20:44:48.974Z", "datePublished": "2026-08-13T01:47:59.370Z", "dateUpdated": "2026-08-13T13:23:00.167Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-08-13T01:47:59.370Z"}, "title": "Prisma Access Agent: Authenticated Limited File Deletion on Linux", "datePublic": "2026-08-12T16:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-132", "descriptions": [{"lang": "en", "value": "CAPEC-132 Symlink Attack"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "26.2.2", "changes": [{"at": "26.2.2", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "platforms": ["macOS", "Windows", "iOS", "Android", "Chrome OS"], "versions": [{"status": "unaffected", "version": "All", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:Linux:*:*", "versionEndExcluding": "26.2.2", "versionStartIncluding": "25.7", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "value": "An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma\u00ae Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.\n\nThe Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma\u00ae Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.</span><b><span><br></span><span><br></span></b><span>The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.</span>"}]}], "references": [{"url": "https://security.paloaltonetworks.com/CVE-2026-0291", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "LOW", "baseScore": 1.1, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber"}}], "configurations": [{"lang": "eng", "value": "No special configuration is required to be affected by this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "No special configuration is required to be affected by this issue."}]}], "workarounds": [{"lang": "en", "value": "No known workarounds or mitigations exist for this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "No known workarounds or mitigations exist for this issue."}]}], "solutions": [{"lang": "eng", "value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nPrisma Access Agent on Linux 25.7 through 26.2.1 Upgrade to 26.2.2 or later.\nPrisma Access Agent on macOS No action needed.\nPrisma Access Agent on Windows No action needed.\nPrisma Access Agent on iOS No action needed.\nPrisma Access Agent on Android No action needed.\nPrisma Access Agent on Chrome OS No action needed.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<table><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>Prisma Access Agent on Linux<br></td>\n <td>25.7 through 26.2.1 </td>\n <td>Upgrade to 26.2.2 or later.</td>\n </tr><tr><td>Prisma Access Agent on macOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on Windows<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on iOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on Android<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on Chrome OS<br></td><td></td><td>No action needed.</td></tr></tbody></table>"}]}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}]}], "timeline": [{"time": "2026-08-12T16:00:00.000Z", "lang": "en", "value": "Initial Publication"}], "credits": [{"lang": "en", "value": "an internal reporter", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "x_affectedList": ["Prisma Access Agent 26.2.0", "Prisma Access Agent 26.0", "Prisma Access Agent 25.0", "Prisma Access Agent 24.0"], "x_cpeGeneratedAt": "2026-08-12T15:37:11.690Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T13:21:52.108031Z", "id": "CVE-2026-0291", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:23:00.167Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0291", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T13:21:52.108031Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:22:50.263Z"}}], "cna": {"title": "Prisma Access Agent: Authenticated Limited File Deletion on Linux", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "an internal reporter"}], "impacts": [{"capecId": "CAPEC-132", "descriptions": [{"lang": "en", "value": "CAPEC-132 Symlink Attack"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 1.1, "Automatable": "NO", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber", "exploitMaturity": "UNREPORTED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "versions": [{"status": "affected", "changes": [{"at": "26.2.2", "status": "unaffected"}], "version": "0", "lessThan": "26.2.2", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "versions": [{"status": "unaffected", "version": "All", "versionType": "custom"}], "platforms": ["macOS", "Windows", "iOS", "Android", "Chrome OS"], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "base64": false}]}], "timeline": [{"lang": "en", "time": "2026-08-12T16:00:00.000Z", "value": "Initial Publication"}], "solutions": [{"lang": "eng", "value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nPrisma Access Agent on Linux 25.7 through 26.2.1 Upgrade to 26.2.2 or later.\nPrisma Access Agent on macOS No action needed.\nPrisma Access Agent on Windows No action needed.\nPrisma Access Agent on iOS No action needed.\nPrisma Access Agent on Android No action needed.\nPrisma Access Agent on Chrome OS No action needed.", "supportingMedia": [{"type": "text/html", "value": "<table><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>Prisma Access Agent on Linux<br></td>\n <td>25.7 through 26.2.1 </td>\n <td>Upgrade to 26.2.2 or later.</td>\n </tr><tr><td>Prisma Access Agent on macOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on Windows<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on iOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on Android<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent on Chrome OS<br></td><td></td><td>No action needed.</td></tr></tbody></table>", "base64": false}]}], "datePublic": "2026-08-12T16:00:00.000Z", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2026-0291", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "No known workarounds or mitigations exist for this issue.", "supportingMedia": [{"type": "text/html", "value": "No known workarounds or mitigations exist for this issue.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma\u00ae Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.\n\nThe Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.", "supportingMedia": [{"type": "text/html", "value": "<span>An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma\u00ae Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.</span><b><span><br></span><span><br></span></b><span>The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "configurations": [{"lang": "eng", "value": "No special configuration is required to be affected by this issue.", "supportingMedia": [{"type": "text/html", "value": "No special configuration is required to be affected by this issue.", "base64": false}]}], "x_affectedList": ["Prisma Access Agent 26.2.0", "Prisma Access Agent 26.0", "Prisma Access Agent 25.0", "Prisma Access Agent 24.0"], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:Linux:*:*", "vulnerable": true, "versionEndExcluding": "26.2.2", "versionStartIncluding": "25.7"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-08-13T01:47:59.370Z"}, "x_cpeGeneratedAt": "2026-08-12T15:37:11.690Z"}}, "cveMetadata": {"cveId": "CVE-2026-0291", "state": "PUBLISHED", "dateUpdated": "2026-08-13T13:23:00.167Z", "dateReserved": "2025-11-03T20:44:48.974Z", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "datePublished": "2026-08-13T01:47:59.370Z", "assignerShortName": "palo_alto"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Prisma Access Agent", "vendor": "Palo Alto Networks", "versions": [{"changes": [{"at": "26.2.2", "status": "unaffected"}], "lessThan": "26.2.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["macOS", "Windows", "iOS", "Android", "Chrome OS"], "product": "Prisma Access Agent", "vendor": "Palo Alto Networks", "versions": [{"status": "unaffected", "version": "All", "versionType": "custom"}]}], "source": "psirt@paloaltonetworks.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:paloaltonetworks:prisma_access_agent:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D48EEFD-6B5C-4AC5-B319-FAF8FBE4EC05", "versionEndExcluding": "26.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma\u00ae Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.\n\nThe Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected."}, {"lang": "es", "value": "Existe una vulnerabilidad de resoluci\u00f3n de enlace incorrecta antes del acceso a archivos en el agente Prisma\u00ae Access de Palo Alto Networks en plataformas Linux que permite a un usuario local con pocos privilegios eliminar archivos del sistema en un \u00e1mbito limitado y deshabilitar el agente Prisma Access.\n\nEl agente Prisma Access en macOS, Windows, iOS, Android y Chrome OS no se ve afectado."}], "id": "CVE-2026-0291", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0291", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T13:21:52.108031Z", "version": "2.0.3"}}]}, "published": "2026-08-13T03:16:43.800", "references": [{"source": "psirt@paloaltonetworks.com", "tags": ["Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2026-0291"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "psirt@paloaltonetworks.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.2.2)"}}, {"platform": ["linux"], "status": "unaffected", "versions": {"scheme": "semver", "value": "26.2.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Prisma Access Agent", "source": "cna", "vendor": "Palo Alto Networks"}, "product": "prisma_access_agent", "vendor": "palo_alto_networks"}, {"configurations": [{"platform": ["macos", "windows", "ios", "android", "chrome_os"], "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Prisma Access Agent", "source": "cna", "vendor": "Palo Alto Networks"}, "product": "prisma_access_agent", "vendor": "palo_alto_networks"}], "created": "2026-08-13T03:30:04.014658+00:00", "updated": "2026-08-13T06:15:15.149598+00:00", "vendors": ["palo_alto_networks", "palo_alto_networks$PRODUCT$prisma_access_agent"]}