Local Privilege Escalation in Prisma Access Agent for Windows

Executive Summary

CVE-2026-0278 involves multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows. These failures allow a local user to bypass DLP policy enforcement controls, effectively evading the intended data loss prevention measures.

The vulnerability affects Windows versions of the Prisma Access Agent below 26.2.1, while the macOS version is not impacted.

Useful 0 Not Useful 0

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local user on a Windows system to bypass DLP policy enforcement controls, potentially leading to unauthorized data exfiltration or leakage.

Since the DLP protections can be circumvented, sensitive or confidential information might be exposed or transferred without detection or prevention.

There are no known workarounds, and the issue requires upgrading to Prisma Access Agent version 26.2.1 or later to mitigate the risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a local user to bypass Data Loss Prevention (DLP) policy enforcement controls in the Prisma Access Agent for Windows. Such a bypass could potentially lead to unauthorized data exposure or leakage, which may impact an organization's ability to comply with data protection regulations like GDPR or HIPAA that require strict controls over sensitive data.

However, the provided information does not explicitly state the direct impact on compliance with these standards or regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, Palo Alto Networks recommends upgrading the Prisma Access Agent on Windows to version 26.2.1 or later.

No workarounds are available for this issue, so applying the update is the immediate and effective mitigation step.

Useful 0 Not Useful 0