CVE-2026-0306: Prisma Access Agent DLP Bypass Vulnerability

CVE-2026-0306 Overview

CVE-2026-0306 is a security control bypass in the Endpoint Data Loss Prevention (DLP) enforcement of the Palo Alto Networks Prisma® Access Agent on Windows. A local, authenticated user can circumvent configured DLP policies and exfiltrate sensitive data that the agent is expected to protect. The flaw maps to [CWE-693: Protection Mechanism Failure], meaning the security control fails to enforce its intended policy rather than being disabled by an external attacker. Prisma Access Agent on macOS, Linux, iOS, Android, and Chrome OS is not affected. Palo Alto Networks published the advisory on September 10, 2026.

Critical Impact
A local user with valid credentials can bypass endpoint DLP controls and exfiltrate confidential data classified as protected by organizational policy.

Affected Products

Palo Alto Networks Prisma® Access Agent on Windows
Non-affected: Prisma Access Agent on macOS and Linux
Non-affected: Prisma Access Agent on iOS, Android, and Chrome OS

Discovery Timeline

2026-09-10 - CVE-2026-0306 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-0306

Vulnerability Analysis

The Prisma Access Agent enforces endpoint DLP policies that inspect and restrict how sensitive data leaves a managed Windows host. CVE-2026-0306 breaks that enforcement path. A local user can perform data movement actions that the configured policy would normally block, monitor, or redact. The result is silent exfiltration of regulated or confidential content without triggering the DLP violation workflow.

Exploitation requires local access and low privileges on the endpoint. No user interaction from a second party is needed, and the attack does not traverse the network. The impact is scoped to the confidentiality and integrity of data governed by the DLP policy, not to the agent's own availability or to other hosts.

Root Cause

The underlying weakness is a Protection Mechanism Failure [CWE-693]. The DLP enforcement layer in the Windows agent fails to apply configured policy controls under conditions reachable by a local user. This is not a memory-safety issue and does not grant code execution or privilege escalation; it defeats the control surface itself, letting normal user actions bypass inspection or blocking rules.

Attack Vector

An authenticated Windows user interacts with the endpoint using standard data-handling operations that the DLP policy is configured to govern, such as file movement, clipboard operations, or upload channels covered by the agent. Because enforcement is not consistently applied, the operation completes and sensitive content leaves the protected boundary. No exploit code, malware, or elevated privileges are required. No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Refer to the Palo Alto Networks CVE-2026-0306 Advisory for vendor-confirmed technical details and fixed versions.

Detection Methods for CVE-2026-0306

Indicators of Compromise

Absence of expected DLP violation events in Prisma Access Agent logs on Windows endpoints where sensitive data handling occurs.
Outbound transfer of files or content matching DLP classifiers without a corresponding block, warn, or audit entry.
Discrepancies between endpoint DLP telemetry on Windows hosts and equivalent macOS or Linux hosts subject to the same policy.

Detection Strategies

Correlate Prisma Access Agent DLP logs with proxy, CASB, and email egress telemetry to identify sensitive content leaving the endpoint without a matching DLP decision.
Baseline expected DLP event volume per user and per policy, then alert on statistically significant drops that may indicate enforcement bypass.
Hunt for user sessions performing bulk read or copy operations against classified file shares that produce no DLP audit records.

Monitoring Recommendations

Forward Prisma Access Agent endpoint logs to a centralized SIEM or data lake for cross-source correlation with network egress data.
Monitor agent version, health, and policy sync status on Windows endpoints to confirm hosts are running a patched build.
Review data exfiltration channels covered by DLP policy (web upload, removable media, cloud sync clients) on a recurring basis to validate enforcement is active.

How to Mitigate CVE-2026-0306

Immediate Actions Required

Inventory all Windows endpoints running the Prisma Access Agent and identify the installed version.
Apply the fixed Prisma Access Agent build for Windows as documented in the Palo Alto Networks advisory.
Restrict local administrative and interactive access on endpoints handling regulated data until patching is complete.
Increase auditing on data repositories classified by DLP policy to detect unexpected access patterns during the remediation window.

Patch Information

Palo Alto Networks has published fixed versions and remediation guidance in the Palo Alto Networks CVE-2026-0306 Advisory. Administrators should consult the advisory for the exact fixed Prisma Access Agent build for Windows and upgrade all affected endpoints. Only the Windows agent is affected; macOS, Linux, iOS, Android, and Chrome OS agents do not require this fix.

Workarounds

Where immediate patching is not possible, enforce compensating controls on network egress paths, including CASB and secure web gateway DLP inspection.
Reduce the population of users with local logon rights on Windows hosts that store or process sensitive data.
Tighten file share and cloud storage permissions so that access to classified content is limited to users with a documented business need.

bash

# Configuration example
# Verify installed Prisma Access Agent version on Windows before and after patching
Get-ItemProperty "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup" | Select-Object Version
Get-Service | Where-Object { $_.Name -like "*PanGP*" -or $_.Name -like "*Prisma*" }