What’s Vulnerable › Vulnerabilities

CVE-2022-0029: Cortex XDR Agent: Improper Link Resolution Vulnerability When Generating a Tech Support File

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-14 · updated 2026-06-17
• Weakness: CWE-59

Description

An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system with elevated privileges when generating a tech support file.

Affected products

• Palo Alto Networks Cortex XDR Agent: from 5.0 before 5.0.12; from 7.5 before 7.5.101; from 7.7 before 7.7.3 — fixed in 5.0.12, 7.5.101, 7.7.3
• Palo Alto Networks Cortex XDR Agent: from 7.7 before 7.7.3; from 7.5 CE before 7.5.101-CE; from 5.0 before 5.0.12-hotfix update — fixed in 7.7.3, 7.5.101-CE, 5.0.12-hotfix update

How to fix

Upgrade to a fixed version: Palo Alto Networks Cortex XDR Agent 5.0.12, 7.5.101, 7.7.3; Palo Alto Networks Cortex XDR Agent 7.7.3, 7.5.101-CE, 5.0.12-hotfix update. Check the vendor advisory for mitigations.

References

• https://security.paloaltonetworks.com/CVE-2022-0029
• https://security.paloaltonetworks.com/CVE-2022-0029

Get alerted when CVE-2022-0029 or the next vulnerability affects your stack