Privilege Escalation in Palo Alto Prisma Access Agent

Executive Summary

This is a privilege escalation vulnerability in the Palo Alto Networks Prisma Access Agent app on Windows and macOS. It allows a local user to execute code with elevated privileges. The Linux, iOS, Android, and ChromeOS versions are not affected.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of the Prisma Access Agent on Windows or macOS systems. Compare it against version 26.3. If the version is below 26.3, the system is vulnerable. Use commands like 'prisma-access-agent --version' on Windows or 'prisma-access-agent -v' on macOS to check the version.

Useful 0 Not Useful 0

Impact Analysis

A local attacker could exploit this to gain higher privileges on your system, potentially allowing them to install malware, access sensitive data, or perform unauthorized actions. The impact is limited to Windows and macOS devices running affected versions of the Prisma Access Agent.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a local privilege escalation issue in a specific application. However, if exploited, it could lead to unauthorized access to sensitive data, potentially violating data protection requirements under GDPR or HIPAA depending on the system configuration and data involved.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade the Prisma Access Agent to version 26.3 or later on all affected Windows and macOS systems. No action is required for Linux, iOS, Android, or ChromeOS devices as they are not impacted.

Useful 0 Not Useful 0