Improper Certificate Validation in Prisma Access Agent for iOS

Executive Summary

CVE-2026-0277 is an improper certificate validation vulnerability found in the Prisma Access Agent for iOS. This flaw allows an attacker to perform a man-in-the-middle (MitM) attack, enabling them to intercept VPN traffic that should be secure.

The vulnerability specifically affects the iOS version of the Prisma Access Agent below version 26.2.1. Other platforms such as Windows, macOS, Linux, Android, and ChromeOS are not affected.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the Prisma Access Agent for iOS to version 26.2.1 or later.

No workarounds are available, so applying the update is the only effective mitigation.

Ensure that only trusted networks are used when connecting with the Prisma Access Agent on iOS to reduce the risk of man-in-the-middle attacks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker positioned on an adjacent network to intercept your VPN traffic through a man-in-the-middle attack. This means sensitive data transmitted over the VPN could be exposed or manipulated.

Exploitation requires the attacker to be on a network close to the victim, but no user interaction is needed. There are no known workarounds, so upgrading to version 26.2.1 or later is necessary to mitigate the risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects the Prisma Access Agent for iOS versions below 26.2.1 and involves improper certificate validation that allows man-in-the-middle attacks on VPN traffic.

There are no specific detection commands or network indicators provided to identify exploitation or presence of this vulnerability on your network or system.

Useful 0 Not Useful 0