CVE-2026-0248: Prisma Access Agent MitM Vulnerability

CVE-2026-0248 Overview

CVE-2026-0248 is an improper certificate validation vulnerability [CWE-295] affecting the Palo Alto Networks Prisma Access Agent on Android and Chrome OS. The flaw allows an attacker on an adjacent network to perform a man-in-the-middle (MitM) attack against VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can intercept the agent's connection and capture sensitive device information. Prisma Access Agent installations on macOS, Windows, Linux, and iOS are not affected.

Critical Impact

An adjacent-network attacker can intercept Prisma Access VPN traffic from Android and Chrome OS clients using any valid CA-issued certificate, exposing device data transmitted through the tunnel.

Affected Products

• Palo Alto Networks Prisma Access Agent for Android
• Palo Alto Networks Prisma Access Agent for Chrome OS
• Not affected: Prisma Access Agent on macOS, Windows, Linux, and iOS

Discovery Timeline

• 2026-05-13 - CVE CVE-2026-0248 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-0248

Vulnerability Analysis

The Prisma Access Agent on Android and Chrome OS fails to correctly validate the server certificate presented during the establishment of the VPN session. The client accepts any certificate signed by a publicly trusted Certificate Authority, regardless of whether the certificate's subject matches the expected Prisma Access service endpoint. This breaks the trust binding between hostname and certificate that TLS relies on to prevent impersonation.

An attacker positioned on an adjacent network — such as the same Wi-Fi segment or a controlled upstream router — can redirect the agent's traffic and present a substitute certificate. Because the agent treats the certificate as legitimate, the TLS handshake completes against the attacker, enabling decryption and modification of tunneled traffic. Captured data may include device identifiers and other sensitive metadata that the agent transmits as part of the VPN session.

Root Cause

The root cause is missing or incomplete certificate pinning and hostname verification in the Android and Chrome OS builds of the Prisma Access Agent. The implementations on macOS, Windows, Linux, and iOS perform the validation correctly, which is why those platforms are not exposed to the same condition.

Attack Vector

Exploitation requires adjacent network access and the ability to issue or obtain a certificate from any trusted public CA for an arbitrary domain. The attacker intercepts the client connection, presents the substitute certificate, and proxies traffic between the agent and the legitimate Prisma Access service. No user interaction or prior authentication is required.

No verified public exploit code is available for this vulnerability. Refer to the Palo Alto Networks Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-0248

Indicators of Compromise

• Unexpected TLS certificates presented to Prisma Access Agent endpoints from CAs or subjects that do not match the legitimate Prisma Access service.
• ARP or DHCP anomalies on Wi-Fi segments where Android or Chrome OS Prisma Access clients connect, indicating possible adjacent-network interception.
• Prisma Access session establishment originating from unusual upstream IP addresses or geolocations relative to the device's expected network path.

Detection Strategies

• Monitor network egress from Android and Chrome OS devices for VPN sessions terminating at hosts that are not authorized Prisma Access points of presence.
• Inspect TLS session metadata (JA3/JA4, SNI, issuer) captured by network sensors to flag Prisma Access traffic negotiating with certificates whose issuer or subject deviates from baseline.
• Correlate mobile device telemetry with Prisma Access cloud logs to identify sessions where the client-reported gateway does not match server-side records.

Monitoring Recommendations

• Enable verbose connection logging on Prisma Access tenants and alert on repeated session re-establishment from the same Android or Chrome OS device.
• Watch for Wi-Fi rogue access point activity in environments where mobile users connect, particularly in shared or public spaces.
• Track Prisma Access Agent version inventory across Android and Chrome OS fleets to confirm patched builds are deployed.

How to Mitigate CVE-2026-0248

Immediate Actions Required

• Upgrade the Prisma Access Agent on all Android and Chrome OS devices to the fixed version specified in the Palo Alto Networks advisory.
• Restrict use of Prisma Access on Android and Chrome OS to trusted networks until the patched agent is deployed.
• Audit MDM-managed device inventories to identify Android and Chrome OS endpoints still running vulnerable agent versions.

Patch Information

Palo Alto Networks has published remediation details in the Palo Alto Networks Advisory for CVE-2026-0248. Apply the vendor-specified fixed releases of the Prisma Access Agent for Android and Chrome OS. The agent on macOS, Windows, Linux, and iOS does not require a patch for this issue.

Workarounds

• Require Android and Chrome OS users to connect only via known, trusted networks (corporate Wi-Fi or cellular) until upgrades are complete.
• Deploy mobile threat defense policies that block VPN initiation when the device is connected to untrusted or open wireless networks.
• Use MDM configuration profiles to enforce certificate trust policies and disable Prisma Access on unpatched Android or Chrome OS builds.

# Example MDM compliance check (conceptual)
# Enforce minimum Prisma Access Agent version on Android/Chrome OS
required_version="<fixed-version-from-advisory>"
installed_version=$(mdm_query --app com.paloaltonetworks.prismaaccess --field version)
if [ "$(printf '%s\n%s' "$required_version" "$installed_version" | sort -V | head -n1)" != "$required_version" ]; then
  mdm_action --device "$DEVICE_ID" --action quarantine --reason "CVE-2026-0248: upgrade Prisma Access Agent"
fi