CVE Explorer
CVE-2026-0245
Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and credentials.
The Prisma Access Agent on Linux, ChromeOS, Android, and iOS are not affected.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1
Preserved source conflicts
No provider value was silently selected as the winner.
affected · 2 assertions
{"defaultStatus":"unaffected","platforms":["Linux","Android","ChromeOS","iOS"],"product":"Prisma Access Agent","vendor":"Palo Alto Networks","versions":[{"status":"unaffected","version":"All","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:5b5502e38a2097d8e0e6748d26be2ebf58082e062e069b09c0d594fe4a4bf6d2 · sha256:d392457a12691a85… · /containers/cna/affected/1
{"defaultStatus":"unaffected","platforms":["macOS","Windows"],"product":"Prisma Access Agent","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"26.2.1","status":"unaffected"}],"lessThan":"26.2.1","status":"affected","version":"0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:5b5502e38a2097d8e0e6748d26be2ebf58082e062e069b09c0d594fe4a4bf6d2 · sha256:d392457a12691a85… · /containers/cna/affected/0
Affected products and versions
2 source assertions{"defaultStatus":"unaffected","platforms":["Linux","Android","ChromeOS","iOS"],"product":"Prisma Access Agent","vendor":"Palo Alto Networks","versions":[{"status":"unaffected","version":"All","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:5b5502e38a2097d8e0e6748d26be2ebf58082e062e069b09c0d594fe4a4bf6d2 · sha256:d392457a12691a85… · /containers/cna/affected/1
{"defaultStatus":"unaffected","platforms":["macOS","Windows"],"product":"Prisma Access Agent","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"26.2.1","status":"unaffected"}],"lessThan":"26.2.1","status":"affected","version":"0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:5b5502e38a2097d8e0e6748d26be2ebf58082e062e069b09c0d594fe4a4bf6d2 · sha256:d392457a12691a85… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":4.3,"baseSeverity":"MEDIUM","exploitMaturity":"UNREPORTED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/AU:N/R:U/V:C/RE:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImp…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:5b5502e38a2097d8e0e6748d26be2ebf58082e062e069b09c0d594fe4a4bf6d2 · sha256:d392457a12691a85… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:5b5502e38a2097d8e0e6748d26be2ebf58082e062e069b09c0d594fe4a4bf6d2 · sha256:d392457a12691a85… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"tags":["vendor-advisory"],"url":"https://security.paloaltonetworks.com/CVE-2026-0245"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:5b5502e38a2097d8e0e6748d26be2ebf58082e062e069b09c0d594fe4a4bf6d2 · sha256:d392457a12691a85… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.