What’s Vulnerable › Vulnerabilities
CVE-2026-0232: Cortex XDR Agent: Local Administrator can disable the agent on Windows
- Severity: medium (CVSS 4.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-13 · updated 2026-10-26
- Weakness: CWE-15
Description
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.
Affected products
- Palo Alto Networks Cortex XDR Agent: from 8.7.0 before 8.7.101; 7.9, 8.3, 8.9.0, 9.0.0 — fixed in 8.7.101
- Palo Alto Networks Cortex XDR Agent: from 9.0 before 9.0.1; from 8.9 before 8.9.1; from 8.7-CE before 8.7.101-CE; from 8.3-CE before 8.3-CE-CU-2120; from 7.9-CE before 7.9-CE-CU-2120 — fixed in 9.0.1, 8.9.1, 8.7.101-CE, 8.3-CE-CU-2120, 8.3-CE, 7.9-CE-CU-2120
How to fix
Upgrade to a fixed version: Palo Alto Networks Cortex XDR Agent 8.7.101; Palo Alto Networks Cortex XDR Agent 9.0.1, 8.9.1, 8.7.101-CE, 8.3-CE-CU-2120. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-0232 or the next vulnerability affects your stack