Cortex XDR Agent: Unintended Program Execution Leads to Local Privilege Escalation (PE) Vulnerability
CVE-2022-0026

6.7MEDIUM

Key Information:

Vendor
Palo Alto Networks
Status
Cortex Xdr Agent
Vendor
CVE Published:
11 May 2022

Badges

👾 Exploit Exists

Summary

A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:) to execute a program with elevated privileges. This issue impacts all versions of Cortex XDR agent without content update 330 or a later content update version.

Affected Version(s)

Cortex XDR Agent Windows 7.7.* without CU-330

Cortex XDR Agent Windows 7.6.* without CU-330

Cortex XDR Agent Windows 7.5 CE 7.5.* without CU-330

References

https://security.paloaltonetworks.com/CVE-2022-0026
x_refsource_MISC

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Palo Alto Networks thanks Xavier DANEST of Decathlon and Yasser Alhazmi for discovering and reporting this issue.
.