Cortex XDR Agent: Unintended Program Execution Leads to Local Privilege Escalation (PE) Vulnerability

CVE-2022-0026
6.7MEDIUM

Key Information

Vendor
Palo Alto Networks
Status
Cortex Xdr Agent
Vendor
CVE Published:
11 May 2022

Badges

👾 Exploit Exists

Summary

A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute a program with elevated privileges. This issue impacts all versions of Cortex XDR agent without content update 330 or a later content update version.

Affected Version(s)

Cortex XDR Agent = 7.7.* without CU-330

Cortex XDR Agent >= 7.7.* with CU-330

Cortex XDR Agent = 7.6.* without CU-330

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit exists.

  • Initial publication

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

Palo Alto Networks thanks Xavier DANEST of Decathlon and Yasser Alhazmi for discovering and reporting this issue.
.