Prisma Access Agent (< 26.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/prisma-access-agent--26.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 09 Sep 2026 18:58:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgInformation Disclosure Vulnerability in Prisma Access Agent for Linuxhttps://feed.craftedsignal.io/briefs/2026-09-prisma-access-disclosure/Wed, 09 Sep 2026 18:58:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-prisma-access-disclosure/An information disclosure vulnerability in the Prisma Access Agent for Linux allows local, low-privileged users to access sensitive configuration data and stored credentials (CVE-2026-0305).Palo Alto Networks has disclosed an information disclosure vulnerability, identified as CVE-2026-0305, affecting the Prisma Access Agent on Linux. The vulnerability stems from the improper exposure of sensitive data, allowing a local user with low-level privileges to read sensitive configuration files and credentials managed by the agent. This issue impacts all versions of the Prisma Access Agent on Linux prior to 26.3. Versions on macOS, Windows, iOS, Android, and Chrome OS are not affected by this vulnerability. There are no known workarounds, and organizations running Prisma Access Agent on Linux should prioritize upgrading to version 26.3 or later to remediate the exposure.

Impact

Successful exploitation of this vulnerability allows a local attacker to access sensitive configuration details and credentials potentially used by the Prisma Access Agent for authentication. This exposure may provide an attacker with the necessary information to pivot within the network or escalate privileges further, depending on the scope of the exposed credentials. There is no evidence of active exploitation in the wild as of the advisory publication date.

Recommendation

  • Upgrade all Prisma Access Agent for Linux installations to version 26.3 or later immediately to address CVE-2026-0305.
  • Audit Linux system configurations to ensure that file permissions for configuration directories are restricted to the minimum required users.
  • Monitor for suspicious local access patterns or unauthorized attempts to read configuration files located in directories associated with the Prisma Access Agent.
]]>mediumthreatvulnerabilityinformation-disclosurelinuxdlp-bypassendpoint-security