What’s Vulnerable › Vulnerabilities
CVE-2025-0121: Cortex XDR Agent: Local Windows User Can Crash the Agent
- Severity: medium (CVSS 6.8 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-04-11 · updated 2026-06-17
- Weakness: CWE-476
Description
A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the agent. Additionally, malware can use this vulnerability to perform malicious activity without Cortex XDR being able to detect it.
Affected products
- Palo Alto Networks Cortex XDR Agent: from 8.6.0 before 8.6.1; from 8.5.0 before 8.5.2; from 8.3-CE before 8.3.101-CE HF; from 7.9-CE before 7.9.103-CE HF — fixed in 7.9.103-CE HF, 8.3.101-CE HF, 8.5.2, 8.6.1
How to fix
Upgrade to a fixed version: Palo Alto Networks Cortex XDR Agent 7.9.103-CE HF, 8.3.101-CE HF, 8.5.2, 8.6.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-0121 or the next vulnerability affects your stack