CVE-2026-0247: Prisma Access Agent Auth Bypass Flaw

CVE-2026-0247 Overview

CVE-2026-0247 describes multiple authorization bypass vulnerabilities in the Endpoint Data Loss Prevention (DLP) component of Palo Alto Networks Prisma Access Agent®. A local attacker with low-level privileges can bypass authentication controls and execute privileged operations on the affected endpoint. The flaw is tracked under CWE-306: Missing Authentication for Critical Function.

Palo Alto Networks published the advisory on May 13, 2026. The vulnerability requires local access but no user interaction, and impacts the confidentiality, integrity, and availability of the agent's protected functions.

Critical Impact

A local, low-privileged user can circumvent the Endpoint DLP authorization layer and invoke privileged operations, undermining data protection controls on the endpoint.

Affected Products

• Palo Alto Networks Prisma Access Agent® - Endpoint DLP component
• Refer to the Palo Alto Networks CVE-2026-0247 Advisory for exact affected versions
• No additional product CPEs were enumerated in the NVD record at publication time

Discovery Timeline

• 2026-05-13 - CVE-2026-0247 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-0247

Vulnerability Analysis

The Endpoint DLP component of Prisma Access Agent exposes privileged operations intended to enforce data loss prevention policies on the host. Multiple authorization checks within this component fail to validate the requesting caller correctly. A local attacker can interact with these interfaces and reach functions reserved for the agent's privileged service context.

Because Endpoint DLP enforces sensitive policy decisions, bypassing its authorization layer permits an attacker to disable controls, modify enforcement state, or trigger privileged actions. The advisory describes the issue as multiple authorization bypass paths rather than a single defect, indicating several entry points share the same root weakness.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The Endpoint DLP interfaces expect callers to be the trusted agent service or an authorized management channel, but the implementation does not enforce that requirement consistently. Code paths that should require elevated identity accept requests from arbitrary local processes running with standard user privileges.

Attack Vector

Exploitation is local. The attacker must already have code execution on the endpoint as a low-privileged user. No social engineering or user interaction is needed. The attacker invokes the exposed Endpoint DLP interface directly and submits requests for privileged operations, which the component executes without proper authorization validation.

No public proof-of-concept code is available for CVE-2026-0247 at the time of writing. Refer to the Palo Alto Networks CVE-2026-0247 Advisory for technical details released by the vendor.

Detection Methods for CVE-2026-0247

Indicators of Compromise

• Unexpected changes to Endpoint DLP policy state, enforcement flags, or local configuration files outside of authorized management workflows.
• Local non-administrative processes opening handles to or issuing IPC requests against the Prisma Access Agent Endpoint DLP service.
• Anomalous child processes spawned by the Prisma Access Agent service following requests from standard user sessions.

Detection Strategies

• Audit local IPC, named pipe, and RPC interactions with the Prisma Access Agent service and alert on callers that are not the expected management binaries.
• Baseline normal Endpoint DLP configuration and generate alerts on out-of-band modifications to policy or telemetry components.
• Correlate local privilege use events with subsequent DLP policy changes to surface bypass attempts.

Monitoring Recommendations

• Forward Prisma Access Agent logs and Windows process and IPC telemetry to a centralized analytics platform for correlation.
• Monitor for repeated failed or malformed requests against DLP service endpoints, which often precede successful bypass attempts.
• Track installed Prisma Access Agent versions across the fleet to confirm patched builds are deployed.

How to Mitigate CVE-2026-0247

Immediate Actions Required

• Review the Palo Alto Networks CVE-2026-0247 Advisory and identify Prisma Access Agent versions deployed in your environment.
• Upgrade affected endpoints to the fixed Prisma Access Agent release identified by Palo Alto Networks.
• Restrict local interactive logon on systems running Prisma Access Agent to reduce the population of users who could exploit a local flaw.

Patch Information

Palo Alto Networks has published its remediation guidance in the Palo Alto Networks CVE-2026-0247 Advisory. Apply the vendor-specified fixed version of Prisma Access Agent across all managed endpoints. The NVD entry was published on 2026-05-13 and last modified on 2026-05-13.

Workarounds

• Limit which local user accounts can run arbitrary code on endpoints enrolled in Prisma Access, reducing exposure to local attackers.
• Enforce application allowlisting to block untrusted binaries that could be used to invoke the vulnerable interfaces.
• Increase logging verbosity for the Prisma Access Agent and review logs until patches are applied.

# Example: query installed Prisma Access Agent version on Windows
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Prisma Access*" } | Select-Object Name, Version