CVE-2023-0002

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
Palo Alto Networks	Cortex XDR agent	>= 7.5, < 7.5.101-CE; >= 5.0, < 5.0.12.22203

References

https://security.paloaltonetworks.com/CVE-2023-0002Vendor Advisory
https://security.paloaltonetworks.com/CVE-2023-0002Vendor Advisory

Timeline

Published: Feb 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-00036.5A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web CVE-2023-00046.5A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the lo CVE-2023-00054.9A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets store CVE-2023-00066.3A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files fro CVE-2023-00074.8A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write CVE-2023-00084.4A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the w CVE-2023-00097.8A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute progr CVE-2023-00105.4A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScr CVE-2023-00116.8A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT command CVE-2023-00126.7In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executa CVE-2023-00136.1The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABA CVE-2023-00149.8SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756,