CVE-2026-0232

mediumpriority · track · 18EPSS 0.001 · 4 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.15% (4th) EPSS

CVSS 4.4 · medium

Is it mine?

23 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.

cvss

Technical severity, 0–10. One row per scoring source.

4.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.4mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 0.8 · impact 3.6

v3.14.4mediumAV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v4.04mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:M/U:Ambersecondary · ENISA EU

v4.04mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Ambersecondary · psirt@paloaltonetworks.com

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-15USCWE-15US

affected products (23)

Products and version ranges known to be affected.

Palo Alto Networks Cortex XDR <8.7.101-CEall versionscert_bundDE
Palo Alto Networks Cortex XDR <8.9.1all versionscert_bundDE
Palo Alto Networks Cortex XDR <9.0.1all versionscert_bundDE
Palo Alto Networks Cortex XDR <9.1.0all versionscert_bundDE
Palo Alto Networks Cortex XDR Content Update <2120all versionscert_bundDE
Palo Alto Networks Cortex XDR≤ Content Update <2120cert_bundDE
Palo Alto Networks Cortex XDR< 8.7.101-CEcert_bundDE
Palo Alto Networks Cortex XDR< 8.9.1cert_bundDE
Palo Alto Networks Cortex XDR< 9.0.1cert_bundDE
Palo Alto Networks Cortex XDR< 9.1.0cert_bundDE
Palo Alto Networks Cortex XDR Agent7.9-CE → 7.9-CE-CU-2120enisa_euvdEU
Palo Alto Networks Cortex XDR Agent8.3-CE → 8.3-CE-CU-2120enisa_euvdEU
Palo Alto Networks Cortex XDR Agent8.7-CE → 8.7.101-CEenisa_euvdEU
Palo Alto Networks Cortex XDR Agent8.9 → 8.9.1enisa_euvdEU
Palo Alto Networks Cortex XDR Agent9.0 → 9.0.1enisa_euvdEU
Palo Alto Networks Inc. Cortex XDR Agent8.7-CE → 8.7.101-CEfstec_bduRU
Palo Alto Networks Inc. Cortex XDR Agent8.9 → 8.9.1fstec_bduRU
Palo Alto Networks Inc. Cortex XDR Agent9.0 → 9.0.1fstec_bduRU
paloaltonetworks cortex xdr agent= 7.9nvdUScpe:2.3:a:paloaltonetworks:cortex_xdr_agent:*:*:*:*:*:*:*:*
paloaltonetworks cortex xdr agent= 8.3nvdUScpe:2.3:a:paloaltonetworks:cortex_xdr_agent:*:*:*:*:*:*:*:*

showing 20 of 23

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1019Palo Alto Networks Cortex XDR Agent: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2026-04-08csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in Palo Alto Networks Cortex XDR Agent ausnutzen, um den Agenten zu deaktivieren, wodurch die Schutzmechanismen des Endgeräts effektiv umgangen werden und weitere böswillige Aktivitäten unbemerkt ausgeführt werden können.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd NVD CVE.org MITRE

published 2026-04-13modified 2026-10-26

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan