CVE-2020-2020: Cortex XDR Agent: Exceptional condition denial-of-service (DoS)

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-09 · updated 2026-06-17
Weakness: CWE-755

Description

An improper handling of exceptional conditions vulnerability in Cortex XDR Agent allows a local authenticated Windows user to create files in the software's internal program directory that prevents the Cortex XDR Agent from starting. The exceptional condition is persistent and prevents Cortex XDR Agent from starting when the software or machine is restarted. This issue impacts: Cortex XDR Agent 5.0 versions earlier than 5.0.10; Cortex XDR Agent 6.1 versions earlier than 6.1.7; Cortex XDR Agent 7.0 versions earlier than 7.0.3; Cortex XDR Agent 7.1 versions earlier than 7.1.2.

Affected products

Palo Alto Networks Cortex XDR Agent: from 5.0 before 5.0.10; from 6.1 before 6.1.7; from 7.0 before 7.0.3; from 7.1 before 7.1.2 — fixed in 5.0.10, 6.1.7, 7.0.3, 7.1.2
Palo Alto Networks Cortex XDR Agent: from 7.0 before 7.0.3; from 7.1 before 7.1.2; from 5.0 before 5.0.10; from 6.1 before 6.1.7 — fixed in 7.0.3, 7.1.2, 5.0.10, 6.1.7

How to fix

Upgrade to a fixed version: Palo Alto Networks Cortex XDR Agent 5.0.10, 6.1.7, 7.0.3, 7.1.2; Palo Alto Networks Cortex XDR Agent 7.0.3, 7.1.2, 5.0.10, 6.1.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-2020 or the next vulnerability affects your stack