CVE-2022-0014

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Windows root directory (such as C:\) to store a program that can then be unintentionally executed by another local user when that user utilizes a Live Terminal session. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.4; Cortex XDR agent 7.3 versions earlier than Cortex XDR agent 7.3.2.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

VendorProductVersions
Palo Alto NetworksCortex XDR Agent>= 7.2, < 7.2.4; >= 7.3, < 7.3.2; >= 5.0, < 5.0.12; >= 6.1, < 6.1.9

References

Timeline

Published
Jan 12, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-00157.8A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user tCVE-2022-00167.8An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalCVE-2022-00177.8An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on WindowCVE-2022-00186.5An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the lCVE-2022-00195.5An insufficiently protected credentials vulnerability exists in the Palo Alto Networks GlobalProtect app on Linux that exposes the hashed crCVE-2022-00205.4A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attCVE-2022-00215.5An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartextCVE-2022-00224.4Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accoCVE-2022-00235.9An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enabCVE-2022-00247.2A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a spCVE-2022-00256.7A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticaCVE-2022-00266.7A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authentica
CVE-2022-0014: High severity, CVSS 7.3 | Vulnix