CVE-2022-0026

Summary

A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:) to execute a program with elevated privileges. This issue impacts all versions of Cortex XDR agent without content update 330 or a later content update version.

Affected Software

VendorProductVersion RangeStatus
Palo Alto NetworksCortex XDR Agent7.7.* without CU-330affected
Palo Alto NetworksCortex XDR Agent7.7.* with CU-330unaffected
Palo Alto NetworksCortex XDR Agent7.6.* without CU-330affected
Palo Alto NetworksCortex XDR Agent7.6.* with CU-330unaffected
Palo Alto NetworksCortex XDR Agent7.5 CE 7.5.* without CU-330affected
Palo Alto NetworksCortex XDR Agent7.5 CE 7.5.* with CU-330unaffected
Palo Alto NetworksCortex XDR Agent7.4.* without CU-330affected
Palo Alto NetworksCortex XDR Agent7.4.* with CU-330unaffected
Palo Alto NetworksCortex XDR Agent6.1.* without CU-330affected
Palo Alto NetworksCortex XDR Agent6.1.* with CU-330unaffected
Palo Alto NetworksCortex XDR Agent7.5.* without CU-330affected
Palo Alto NetworksCortex XDR Agent7.5.* with CU-330unaffected

Weaknesses

  • CWE-282: CWE-282 Improper Ownership Management

Workarounds

There are no known workarounds for this issue.

ADP Enrichment

CVE Program Container

Additional References

References