CVE-2024-5907: Cortex XDR Agent: Local Privilege Escalation (PE) Vulnerability

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-12 · updated 2026-06-17
Weakness: CWE-269

Description

A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute programs with elevated privileges. However, execution does require the local user to successfully exploit a race condition, which makes this vulnerability difficult to exploit.

Affected products

Palo Alto Networks Cortex XDR Agent: from 7.9 before 7.9.102; from 8.1 before 8.2.3; from 8.3 before 8.3.1 — fixed in 7.9.102, 8.2.3, 8.3.1
Palo Alto Networks Cortex XDR Agent: from 7.9-CE before 7.9.102-CE; from 8.2.0 before 8.2.3; from 8.3.0 before 8.3.1; 8.1.0 — fixed in 7.9.102-CE, 8.2.3, 8.3.1

How to fix

Upgrade to a fixed version: Palo Alto Networks Cortex XDR Agent 7.9.102, 8.2.3, 8.3.1; Palo Alto Networks Cortex XDR Agent 7.9.102-CE, 8.2.3, 8.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-5907 or the next vulnerability affects your stack