CVE-2026-0291: Prisma Access Agent Privilege Escalation

CVE-2026-0291 Overview

CVE-2026-0291 is an improper link resolution before file access vulnerability [CWE-59] in the Palo Alto Networks Prisma Access Agent on Linux platforms. A local low-privileged user can leverage the flaw to delete system files within a limited scope and disable the Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.

The issue is scoped to local exploitation and requires existing low-privileged access to the target host. Palo Alto Networks published the advisory on August 13, 2026.

Critical Impact
A local attacker with low privileges can delete system files in a limited scope and disable the Prisma Access Agent on affected Linux endpoints, degrading endpoint VPN and access enforcement.

Affected Products

Palo Alto Networks Prisma Access Agent on Linux
Prisma Access Agent versions as identified in the Palo Alto Networks CVE-2026-0291 Advisory
Not affected: Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS

Discovery Timeline

2026-08-13 - CVE-2026-0291 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-0291

Vulnerability Analysis

The vulnerability is a symbolic link (symlink) handling flaw classified as improper link resolution before file access [CWE-59]. The Prisma Access Agent on Linux performs file operations without adequately validating whether a target path is a symbolic link controlled by an unprivileged user. An attacker can plant a symlink that redirects a privileged file operation to a system file, causing that file to be deleted when the agent processes it.

The scope is limited: the attacker cannot write arbitrary content but can delete files that the agent has permission to remove. Deleting files that the agent depends on effectively disables the Prisma Access Agent, breaking secure connectivity policies enforced by the endpoint.

Root Cause

The root cause is the absence of safe file-handling primitives when the agent operates on paths in user-writable directories. Instead of using O_NOFOLLOW, file descriptor–based operations, or path canonicalization prior to acting, the agent follows symbolic links planted by a local user. This TOCTOU-adjacent condition allows redirection of file deletion to attacker-chosen locations within the agent's privilege bounds.

Attack Vector

Exploitation requires local access with low privileges on a Linux host running the affected Prisma Access Agent. The attacker plants a symlink in a location the agent processes, then triggers or waits for the agent operation that resolves the link. When the agent removes the target, the referenced system file is deleted instead, disabling the agent or degrading system state within the agent's write scope. No user interaction beyond the local session is required, and no network access is needed.

No public proof-of-concept is available at the time of publication. See the Palo Alto Networks CVE-2026-0291 Advisory for vendor technical details.

Detection Methods for CVE-2026-0291

Indicators of Compromise

Unexpected creation of symbolic links in directories written to by the Prisma Access Agent, particularly links pointing to files under /etc, /var, or Prisma Access installation paths.
Sudden termination or failure to start of Prisma Access Agent services on Linux endpoints without a corresponding administrator action.
Missing or truncated agent configuration, log, or binary files that were previously present.

Detection Strategies

Monitor Linux audit logs (auditd) for symlink, symlinkat, and unlink/unlinkat syscalls executed by unprivileged users in paths the Prisma Access Agent accesses.
Alert on file deletion events targeting Prisma Access Agent binaries, configuration files, or system files whose deletion path resolves through a user-controlled symlink.
Correlate agent service state changes with recent file system activity by non-root users on the same host.

Monitoring Recommendations

Enable file integrity monitoring on Prisma Access Agent installation directories and critical Linux system paths.
Track the health and heartbeat status of the Prisma Access Agent centrally to identify hosts where the agent becomes unexpectedly disabled.
Retain endpoint process and file telemetry long enough to reconstruct symlink-based abuse patterns during investigation.

How to Mitigate CVE-2026-0291

Immediate Actions Required

Identify all Linux endpoints running the Prisma Access Agent and inventory current installed versions.
Apply the fixed version listed in the Palo Alto Networks CVE-2026-0291 Advisory as soon as it is validated in your environment.
Restrict local shell access on Linux endpoints to trusted administrators to reduce the pool of users who can stage a symlink attack.

Patch Information

Palo Alto Networks has published guidance for CVE-2026-0291 in the vendor advisory. Refer to the Palo Alto Networks CVE-2026-0291 Advisory for the definitive list of fixed versions and upgrade instructions for the Prisma Access Agent on Linux.

Workarounds

Limit interactive local user accounts on Linux endpoints running the Prisma Access Agent until the patch is applied.
Enforce strict permissions (0700 or tighter) on any directory the agent writes to that also permits access by non-root users.
Enable Linux kernel protections such as fs.protected_symlinks=1 and fs.protected_hardlinks=1 to reduce symlink abuse in world-writable directories.

bash

# Enable kernel-level symlink and hardlink protections on Linux endpoints
sudo sysctl -w fs.protected_symlinks=1
sudo sysctl -w fs.protected_hardlinks=1

# Persist the settings across reboots
echo 'fs.protected_symlinks=1' | sudo tee -a /etc/sysctl.d/99-symlink-hardening.conf
echo 'fs.protected_hardlinks=1' | sudo tee -a /etc/sysctl.d/99-symlink-hardening.conf

# Verify current Prisma Access Agent version
rpm -q GlobalProtect 2>/dev/null || dpkg -l | grep -i globalprotect