CVE-2026-0232

MediumCVSS 4.4/10Last modified Jul 7, 2026

Description

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-15

Affected software

No affected versions have been published.

Timeline

Published: Apr 13, 2026
Last modified: Jul 7, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-02338.8A certificate validation vulnerability in Palo Alto Networks Autonomous Digital Experience Manager on Windows allows an unauthenticated atta CVE-2026-02349.1An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Mi CVE-2026-02354.7A race condition vulnerability in Palo Alto Networks Prisma® Browser enables a locally authenticated non-admin user to bypass certain access CVE-2026-02367.8A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface CVE-2026-02377.8An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to a CVE-2026-02383.2A vulnerability in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into certain Broker VM fie CVE-2026-02396.5An information disclosure vulnerability in the Chronosphere Chronocollector enables an unauthenticated attacker with network access to the c CVE-2026-02408.7An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information fro CVE-2026-02417.2Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized ac CVE-2026-02426.1A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the CVE-2026-02436.5A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attacker in a network adj CVE-2026-02448.1An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to im