CVE-2022-0026

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute a program with elevated privileges. This issue impacts all versions of Cortex XDR agent without content update 330 or a later content update version.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-282

Affected software

Vendor	Product	Versions
Palo Alto Networks	Cortex XDR Agent	7.7.* without CU-330; 7.6.* without CU-330; 7.5 CE 7.5.* without CU-330; 7.4.* without CU-330; 6.1.* without CU-330; 7.5.* without CU-330

References

https://security.paloaltonetworks.com/CVE-2022-0026Vendor Advisory
https://security.paloaltonetworks.com/CVE-2022-0026Vendor Advisory

Timeline

Published: May 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-00274.3An improper authorization vulnerability in Palo Alto Network Cortex XSOAR software enables authenticated users in non-Read-Only groups to ge CVE-2022-00288.6A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service CVE-2022-00295.5An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read file CVE-2022-00308.1An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific know CVE-2022-00316.7A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system a CVE-2022-00708.8Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly m CVE-2022-00718.8Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the CVE-2022-00725.8Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Travers CVE-2022-00738.8Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Comman CVE-2022-00748.8Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege E CVE-2022-00795.3showdoc is vulnerable to Generation of Error Message Containing Sensitive Information CVE-2022-00809.8mruby is vulnerable to Heap-based Buffer Overflow