Attack Chain

1. The attacker positions themselves in a network path between the Android/Chrome OS device and the VPN server.
2. The user initiates a VPN connection via the Prisma Access Agent.
3. The attacker intercepts the initial TLS handshake.
4. The attacker presents a fraudulent certificate for a domain issued by a trusted Certificate Authority.
5. Due to the improper certificate validation, the Prisma Access Agent on the Android/Chrome OS device accepts the fraudulent certificate.
6. A secure channel is established between the device and the attacker, appearing as a legitimate VPN connection.
7. All VPN traffic is now routed through the attacker’s machine, allowing the attacker to inspect and modify data in transit.
8. The attacker captures sensitive device information transmitted through the VPN connection.

Impact

Successful exploitation of CVE-2026-0248 allows an attacker to perform a man-in-the-middle attack on VPN connections established by the Prisma Access Agent on affected Android and Chrome OS devices. This can lead to the disclosure of sensitive information, such as credentials, personal data, or proprietary business data, transmitted through the VPN. The severity is rated as medium due to the adjacent attack vector.

Recommendation

• Upgrade Prisma Access Agent on Android and Chrome OS devices to version 26.2.1 or later to remediate CVE-2026-0248.
• Deploy the Sigma rules below to detect potential man-in-the-middle attacks targeting Prisma Access Agent connections.