CVE-2026-0291
Received Received - Intake

Improper Link Resolution Leads to File Deletion in Prisma Access Agent

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Palo Alto Networks, Inc.

Description
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-0291
EUVD
EUVD-2026-57705

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
palo_alto_networks prisma_access_agent to 26.2.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an improper link resolution before file access vulnerability in the Palo Alto Networks Prisma Access Agent on Linux. It allows a local low-privileged user to delete system files in a limited scope and disable the agent. The issue does not affect macOS, Windows, iOS, Android, or Chrome OS versions.

Detection Guidance

Check the installed version of Prisma Access Agent on Linux using the command 'prisma-access-agent --version'. If the version is earlier than 26.2.2, the system is vulnerable.

Impact Analysis

A local low-privileged user could delete system files and disable the Prisma Access Agent on Linux systems running affected versions. This could disrupt secure network access and require administrative intervention to restore functionality.

Compliance Impact

This vulnerability has limited direct impact on compliance with standards like GDPR or HIPAA. It allows a local low-privileged user to delete system files and disable the Prisma Access Agent on Linux, but the scope is restricted and does not affect confidentiality, integrity, or availability of sensitive data. The CVSS score indicates low impact, and no exploitation has been reported.

Mitigation Strategies

Upgrade the Prisma Access Agent on Linux to version 26.2.2 or later immediately. No other workarounds are currently available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-0291. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart